Authentication

#Send your key

Send the key in the Authorization header with the Bearer scheme, or in the X-Api-Key header. Send exactly one of them: a request with both is rejected.

GET /v1/drugs?country=ca&q=metformin
Host: api.medifontis.com
Authorization: Bearer mf_live_…

GET /v1/drugs?country=ca&q=metformin
Host: api.medifontis.com
X-Api-Key: mf_live_…

#Key format

Keys start with mf_live_ followed by 64 hexadecimal characters. Medifontis stores only a SHA-256 hash of your key, so it cannot show it to you again: copy it when you create it.

#Keep keys secret

• Call the API from your backend, never from browser JavaScript or a mobile app.
• Store the key in an environment variable or a secret manager, not in source control.
• Use one key per application, so you can replace one without touching the others.

#Proxy requests from your frontend

For a search box in a web page, forward the query through an endpoint of your own that adds the key:

// Express: the browser calls /api/medicines, your server calls Medifontis.
app.get('/api/medicines', async (request, response) => {
  const params = new URLSearchParams({ country: 'ca', q: String(request.query.q || '') })
  const upstream = await fetch(`https://api.medifontis.com/v1/drugs?${params}`, {
    headers: { Authorization: `Bearer ${process.env.MEDIFONTIS_API_KEY}` },
  })
  response.status(upstream.status).json(await upstream.json())
})

#Replace or revoke a key

You can create a new key from the signup page at any time. To revoke a key you no longer use, write to us from the contact page. Contact us.

#Authentication errors

• 401 The key is missing, malformed, revoked or expired, or both headers were sent.
• 403 The key is valid but does not permit this search.