Access Tokens expire after 30 minutes. Always generate a fresh token server-side immediately before loading an Element. Never expose your API key in client-side code.
All of our components are authenticated using Access Tokens. These Access Tokens are short-lived tokens that must be obtained immediately before loading the relevant web component.
To generate an Access Token, you can utilize the Hero Health Public API. To do so, it's necessary to create an endpoint on your server that securely interacts with the Hero Health Public API for Access Token generation. This endpoint should enforce robust authentication measures and restrict access solely to authenticated users within your system.
Note that if your application uses a server-side rendered approach, you can call the Hero Health Public API to generate an Access Token directly, as long as it does not come from the frontend.
For Elements that enable writeback into the clinical record (e.g. consultation, messaging, inbox), you may want to provide admin context into the Element to ensure that the author on the writeback matches the user performing those actions.
In order to do this, you will need to pass the user's corresponding Hero admin ID into the x-admin-id header on generation of the Access Token to ensure that this context is available within the Element. The user will also need to hold sufficient RBAC permissions to perform a writeback.
In the absence of this header, the system will fall back to the default partner user (as set up during partner onboarding), or failing that the default Hero service user for the integration (as set up by the practice during practice onboarding).
Example
<script src="https://scripts.htech.app/message-builder/web-component/latest.js"></script>You'll need to write a script to render the Web Component when you receive the Access Token from the server. This can be accomplished in various ways, but you can refer to the example below:
Example
Suppose you are using a server-side rendering approach in your application. In that case, you can retrieve the access token on render time and inject it directly into the Message Builder component.
Be aware that the Access Token expires in 30 minutes, so caching strategies can lead to authentication errors.