Chia Health Authentication

generated: '2026-11-03'
method: searched
source: https://partners.chia.health/docs/environments/
docs: https://partners.chia.health/docs/environments/
summary:
  types:
  - http
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: chia_test_… / chia_test_finance_… / chia_live_… / chia_live_finance_…
  description: 'Every request sends `Authorization: Bearer ${CHIA_RUNTIME_KEY}` or `Authorization: Bearer
    ${CHIA_FINANCE_KEY}` from confidential server workloads only. Credentials are environment-, tenant-
    and role-bound; tenant identity is derived from the credential, never from a caller-supplied header.
    No self-service issuance: six values (sandbox/production x runtime/finance/webhook) are delivered
    via signed onboarding through an approved secret channel.'
  sources:
  - openapi/chia-health-openapi.yml
  - https://partners.chia.health/docs/environments/
  key_prefixes:
    sandbox_runtime: chia_test_…
    sandbox_finance: chia_test_finance_…
    production_runtime: chia_live_…
    production_finance: chia_live_finance_…
    sandbox_webhook_secret: whsec_test_…
    production_webhook_secret: whsec_live_…
  roles:
  - role: runtime catalog/handoff service; ephemeral test job
    secret: runtime key
    allowed: [catalog:read, handoffs:create, authenticated asset GET, webhooks:test]
  - role: webhook receiver
    secret: current signing secret; optionally one retiring secret
    allowed: [verify inbound Chia events]
  - role: finance worker
    secret: finance key
    allowed: [settlements:read]
  - role: mobile app
    secret: none
    allowed: [partner-projected cards and OS-browser navigation]
  rotation: Provision and validate the replacement key, switch the workload, then revoke the old key;
    webhook secrets overlap with at most two signing secrets during rotation.
- name: affiliateBearer
  type: http
  scheme: bearer
  api: Chia affiliate read API (/api/affiliate/v1, limited pilot)
  bearerFormat: chia_aff_live_<12 lowercase hex>_<43 URL-safe characters> / chia_aff_test_…
  description: Separate credential issued by the named Chia affiliate integration owner; no self-service
    issuance. Every authentication and authorisation failure returns one identical opaque 401.
  sources:
  - https://partners.chia.health/docs/affiliate-read-api/
webhook_signing:
  scheme: HMAC over the exact raw body, single `v1` signature, 300-second timestamp tolerance
  docs: https://partners.chia.health/docs/webhooks/