Authentication

The API accepts two credentials:

• API keys — Authorization: Bearer <key>. Use these for integrations, scripts, and the playground on these pages.
• Session cookies — set by the SmileLine app after sign-in. The app uses these; your integration should not.

API keys

API keys are managed through the auth endpoints under /auth/api-key/* while signed in. A key acts as the user who created it: same organizations, same role, same permissions.

curl https://api.smileline.io/patients?limit=10 \
  -H "Authorization: Bearer $SMILELINE_API_KEY"

Who am I?

GET /auth/me returns the authenticated user, the active organization, and your member role — useful as a connectivity check and to confirm which organization your requests will hit.

{
	"user": { "id": "…", "email": "…", "name": "…" },
	"session": { "activeOrganizationId": "…" },
	"organization": { "id": "…", "name": "…" },
	"memberRole": "owner"
}

Roles and permissions

Every member of an organization has a role: owner, admin, or member. Reads are open to all members; writes are gated per resource — for example creating patients requires patient:create, archiving a pipeline requires pipeline:delete. A request without the needed permission returns 403 with the standard error envelope.

Endpoints not listed in the sidebar

The generated reference covers the CRM API. A few surfaces live outside it:

Public endpoints

Three surfaces require no authentication:

• GET /health — liveness check.
• POST /capture/{token} — public lead intake. The unguessable token in the URL identifies your practice; see Lead capture.
• POST /webhooks/* — inbound provider webhooks, verified by signature. See Webhooks.

Everything else returns 401 without valid credentials.