Skip to content
Thea HealthThea HealthThea Health Developers

Environments and keys

Thea runs two separate environments. They share nothing: keys, practices, patients, cases, and webhook endpoints in one don’t exist in the other.

Sandbox Live
Base URL https://dev.theahealth.com/api/partner/v1 https://app.theahealth.com/api/partner/v1
Partner key prefix thea_sk_test_ thea_sk_live_
Practice key prefix thea_pk_test_ thea_pk_live_
Connect URL https://dev.theahealth.com/connect/{partner_slug} https://app.theahealth.com/connect/{partner_slug}
Data Test practices and fictional patients only Real practices and patients (PHI)
Notifications Suppressed or sent to your team Sent to real clinicians
Requires a BAA No Yes

Keys only work in their own environment. Sending a test key to the live URL (or the reverse) returns 401 unauthenticated.

Getting keys

Section titled “Getting keys”

Partner keys are issued by Thea, not self-served. Practice keys come from each practice connecting to you.

  1. Email support@theahealth.com with your organization’s name, a technical contact, what you’re building, the scopes you need, and the redirect_uris you’ll use for the connect flow.
  2. Thea sets up your partner account and a connected sandbox practice. We send you a thea_sk_test_ partner key, the test practice’s thea_pk_test_ key and practice ID, your partner_slug, and a test practice admin login so you can try the connect flow yourself. Keys are shown only once, so store them in a secrets manager.
  3. Build and test against the sandbox. The Quickstart walks through a full eConsult.
  4. When you’re ready to go live, Thea signs a Business Associate Agreement with your organization and sends your live partner key securely. Live practices then connect to you through the connect flow, and each one gives you its live practice key.

Rotating and revoking keys

Section titled “Rotating and revoking keys”

You can hold more than one active partner key, so rotate without downtime:

  1. Ask Thea for a new partner key.
  2. Deploy it, then confirm it works with a read such as GET /specialties.
  3. Ask Thea to revoke the old one. Revoked keys stop working immediately.

To rotate a practice key, send the practice through the connect flow again. The new key replaces the old one immediately.

If a key may have leaked, email support@theahealth.com straight away and we’ll revoke it.