This article is for developers. If you run a clinic and are not integrating other software with Treatlly, you can skip it — nothing here is needed for normal use.
Treatlly offers a REST API so a clinic can connect other systems to its own data. It is optional, off by default, and used by a small minority of clinics.
When you would use it
- Pushing appointments or payments into an existing accounting system.
- Pulling booking data into your own reporting.
- Connecting a third-party tool a clinic group already runs.
If your need is "I want to see my numbers", the built-in reporting is almost certainly quicker than an integration.
Getting a key
A clinic admin generates API keys under Clinic Settings → API Access.
- Open Clinic Settings → API Access.
- Generate a new key.
- Copy it immediately. Keys are shown once — if you lose it, generate a new one.
- Store it somewhere your team can retrieve it safely.
Authentication
Requests authenticate with the key. It identifies your clinic, so every request is automatically scoped to your own data — there is no way to reach another clinic's records with your key.
Treat the key like a password
This is the part worth taking seriously. An API key can read clinic data, which means patient data.
- Never put a key in front-end code, a mobile app, or anything a user can view the source of.
- Never commit one to a shared repository.
- Never send one over WhatsApp or email.
- Rotate it when a developer with access moves on.
- Generate separate keys for separate integrations, so one can be revoked alone.
If a key may have leaked, generate a replacement immediately. The old one stops working, which is exactly what you want.
What the API covers
Broadly, appointments, patients, doctors and payments — the same information your staff see, scoped to your clinic. It is not a route around role permissions: a key gives programmatic access to clinic data, so who holds it matters as much as who is an admin.
Rate limits and good behaviour
Requests are rate-limited to keep the platform responsive for everyone. Poll sensibly — once a minute is plenty for most integrations, and once a day is plenty for reporting.
Handle failures gracefully. A network error should be retried with a delay, not hammered.
Mobile applications
Treatlly's own patient and staff apps use their own authenticated interfaces, not these keys. If you are trying to build against the mobile app, that is a different conversation — talk to us.
Getting help
For endpoint-level detail, or to discuss an integration before building it, contact us. Tell us what you are trying to achieve rather than which endpoint you want — there is often a simpler route.