Get your API key
Where to find your Medos API key and how to keep it safe.
Every widget instance needs an API key to talk to the Medos backend. The key identifies your workspace and lets the widget fetch doctors, slots, and create bookings.
Where to find it
Sign in to your Medos dashboard.
Go to Account Settings → API Keys
(/dashboard/account-settings/api-keys).
Copy the value from the Secret Key column of the key you want to use.
Don't have a key yet? Use Add API Key, give it a name, and pick the workspace it belongs to.
Key format
Every Medos key is prefixed with mk_, followed by a long random string:
mk_••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••Copy the whole value, including the mk_ prefix. In the samples throughout
these docs the key is written as mk_your_publishable_key — replace that
with your own key.
Don't paste a real key into a screenshot or a public repo
Treat the key like any other credential when you're sharing screens, filing issues, or committing code. If a key does leak, delete it in Account Settings → API Keys and create a new one — revoking is immediate.
Safe to expose in the browser
Publishable keys are designed to be embedded in client-side code. The widget exchanges the key for a short-lived session token when it starts, so the key itself never authorizes destructive operations directly.
That said, you should still:
- Delete keys you no longer use — revoking is immediate.
- Use one key per site so you can revoke one without breaking the others.
- Never commit keys for production environments to a public repo — use environment variables or a build-time inject step instead.
Origin-bound keys
A browser key can be locked to a single allowed origin. Once it is, the widget only works when loaded from that domain — a copied key pasted into someone else's site is rejected.
| Key type | Locked to an origin? | Use it for |
|---|---|---|
| Browser key | Yes — one origin per key | The widget on your public site |
| Server key | No | Backend integrations that never touch a browser |
Origin binding is set by Medos, not in the dashboard
The allowed origin isn't editable in Account Settings → API Keys — it's configured on the Medos side. Ask your Medos contact to bind a key to your domain, or to issue you a key per domain if you need separate ones for local, staging, and production.
Subdomains count as different origins, and so do http and https. A key
bound to https://yourclinic.com will not work on
https://www.yourclinic.com or http://localhost:3000.
Symptom of an origin mismatch
If the widget fails to start and onError reports an authentication or
forbidden error, the most likely cause is the key being bound to a
different domain than the page it's running on. This is also why a
production key won't render in the Playground.