Skip to main content

​
Authentication

You need a client_id and client_secret to interact with the Cobalt API. You will also need an access_token for each user which can be obtained in through the Cobalt Link flow.

​
Headers

​
Example Request

​
Access Tokens

Access tokens are obtained through the Cobalt Link flow. Each access token is associated with a specific set of EHR credentials. An access token alone cannot be used against the API — every request also requires your client_id and client_secret.

​
Rotating and Revoking Access Tokens

If a token may have been exposed, rotate it: a new token is returned and the old one is invalidated immediately. The user’s EHR connection is unaffected and no re-link is required. Requests with a rotated-out token return 401. To rotate many tokens at once, loop the rotate endpoint over your stored tokens. To revoke a user’s access entirely, deactivate the account. Subsequent requests with that token return 403 with "error": "login_required", and the user reconnects through the normal Cobalt Link flow. For a broad compromise, lock your client: every token and EHR session under your client is invalidated immediately and your client_secret is cleared. Contact support to unlock.