hi.health · Authentication Profile

Hihealth Authentication

Authentication

hi.health secures its APIs with oauth2 across 1 declared security scheme, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CompanyInsurancePaymentsCardsFintechHealthCards-as-a-ServiceEmbedded FinanceReimbursementClaims
Methods: oauth2 Schemes: 1 OAuth flows: clientCredentials API key in:

Security Schemes

OAuth2ClientCredentials oauth2

Source

Authentication Profile

hihealth-authentication.yml Raw ↑ 
generated: '2026-07-19'
method: searched
source: https://partner.getpliant.com/docs/authenticated-api-usage.md
docs: https://partner.getpliant.com/docs/authenticated-api-usage.md
summary:
  types:
  - oauth2
  oauth2_flows:
  - clientCredentials
  api_key_in: []
schemes:
- name: OAuth2ClientCredentials
  type: oauth2
  flow: clientCredentials
  identity_provider: Auth0
  token_urls:
    production: https://infinnityprodinternal.eu.auth0.com/oauth/token
    sandbox: https://infinnitystaginginternal.eu.auth0.com/oauth/token
  audience:
    production: api.getpliant.com/api/integration
    sandbox: api.staging.infinnitytest.com/api/integration
  grant_type: client_credentials
  credentials: client_id + client_secret (issued during partner onboarding)
  token_type: Bearer
  token_ttl_seconds: 86400
  token_header: 'Authorization: Bearer <token>'
  constraint: >-
    The authorization flow must be handled exclusively by a secure backend;
    web frontends and mobile apps must not call the API directly or expose
    credentials.
notes: >-
  Bearer tokens are valid until their TTL (24h) is reached and are not
  invalidated earlier. Fetch a new token shortly before expiry. Scope/permission
  model is documented separately (see scopes/hihealth-scopes.yml).