Going live
How to develop safely, and what to check before you put the widget in front of real patients.
Bookings the widget creates are real — they land in your workspace and notify the doctor and patient. Plan your testing around that.
There is no separate test key format
Medos API keys don't have a test/live variant. A key is scoped to one workspace, and whatever you book with it lands in that workspace.
So isolation comes from which workspace you point at, not from a special key:
Use a separate workspace for development
Ask your Medos admin for a non-production workspace with its own doctors and its own API key. Develop against that, and switch the key when you ship. Bookings stay out of your live schedule and no real patient is notified.
One script URL, everywhere
There's a single production endpoint, and it's the same one in development and in production:
<script src="https://widgets.medos.one/v2/unified.js"></script>The API endpoint is compiled into the bundle, so there's no baseUrl or
environment switch to set. What changes between development and production is
only which key you pass.
What you can control on a key
| Property | Set by | Notes |
|---|---|---|
| Name | You, in the dashboard | Label so you can tell keys apart |
| Workspace | You, at creation | Which clinic's data the key can reach |
| Active / revoked | You, in the dashboard | Delete a key to stop it working immediately |
| Expiry | Medos | Keys can be issued with an expiry date |
| Allowed origin | Medos | Locks a browser key to one domain — see API keys |
Pre-launch checklist
Complete a real booking end to end in your development workspace — including OTP, and payment if your workspace collects it.
Check both flows if you use them. Book with a scheduled doctor and a
queue doctor, and confirm the confirmation screen looks right for each.
Don't gate go-live on post-booking callbacks —
onSuccess doesn't fire yet.
Verify the confirmation SMS and email your patients will actually receive.
Swap in the production key and confirm it's allowed on your production domain. If the key is origin-bound to a domain you're not serving from, the widget won't start.
Test on a real phone, not just a resized desktop window. The widget switches layout based on available width.
Confirm your CSP allows the widget script, the Medos API, and your
font host if you use fontUrl. See
Troubleshooting.
After launch
Keys are listed in Account Settings → API Keys with the workspace they belong to. Delete a key there to revoke it immediately — any page still using it stops working, so swap the key in your site first.