Stedi Authentication

generated: '2026-08-15'
method: searched
docs: https://www.stedi.com/docs/healthcare/api-reference
docs_account: https://www.stedi.com/docs/healthcare/account-settings
key_management_url: https://portal.stedi.com/app/settings/developer/api-keys
searched_detail:
  header_format: 'Authorization: <API_KEY>'
  legacy_header_format: 'Authorization: Key <API_KEY>'
  legacy_note: The `Key ` prefix form is still supported for backwards compatibility.
  key_types: [Test, Production]
  key_expiry: Keys never expire automatically; revoke by deleting the key.
  key_permissions: >
    Production API keys inherit the permissions of the account member who created them, and
    retain those permissions even if that member's role is later changed — a standing
    privilege-creep hazard an integrator should audit.
  oauth_on_rest: false
  oauth_on_mcp: true
  oauth_detail: scopes/stedi-scopes.yml
  mtls: false
  ip_allowlisting: >
    Not offered as a customer control, but Stedi's AWS WAF applies IP-reputation rules that can
    return 403 for legitimate traffic (commonly from Google Cloud egress), and CMS eligibility
    requests are blocked when any IP in the X-Forwarded-For chain is outside the United States.
  webhook_auth:
    direction: inbound-to-customer
    scheme: 'Standard Webhooks HMAC-SHA256 signature (webhook-signature: v1,{signature})'
    secret_format: whsec_...
    detail: asyncapi/stedi-event-destinations-asyncapi.yml
derived_from: openapi/stedi-batch-eligibility-check-api-openapi.yml, openapi/stedi-claim-acknowledgments-api-openapi.yml,
  openapi/stedi-claim-attachments-api-openapi.yml, openapi/stedi-claim-submission-api-openapi.yml,
  openapi/stedi-coordination-of-benefits-api-openapi.yml, openapi/stedi-documents-api-openapi.yml,
  openapi/stedi-eligibility-pdf-api-openapi.yml, openapi/stedi-enrollments-api-openapi.yml,
  openapi/stedi-event-destinations-api-openapi.yml, openapi/stedi-events-api-openapi.yml, openapi/stedi-executions-api-openapi.yml,
  openapi/stedi-fragments-api-openapi.yml ...
summary:
  types:
  - apiKey
  api_key_in:
  - header
schemes:
- name: httpApiKeyAuth
  type: apiKey
  in: header
  parameter: Authorization
  description: A [Stedi API Key](https://portal.stedi.com/app/settings/api-keys) for authentication.
  sources:
  - openapi/stedi-batch-eligibility-check-api-openapi.yml
  - openapi/stedi-claim-acknowledgments-api-openapi.yml
  - openapi/stedi-claim-attachments-api-openapi.yml
  - openapi/stedi-claim-submission-api-openapi.yml
  - openapi/stedi-coordination-of-benefits-api-openapi.yml
  - openapi/stedi-documents-api-openapi.yml
  - openapi/stedi-eligibility-pdf-api-openapi.yml
  - openapi/stedi-enrollments-api-openapi.yml
  - openapi/stedi-event-destinations-api-openapi.yml
  - openapi/stedi-events-api-openapi.yml
  - openapi/stedi-executions-api-openapi.yml
  - openapi/stedi-fragments-api-openapi.yml
  - openapi/stedi-insurance-discovery-api-openapi.yml
  - openapi/stedi-partnerships-api-openapi.yml
  - openapi/stedi-payer-api-openapi.yml
  - openapi/stedi-payers-api-openapi.yml
  - openapi/stedi-polling-api-openapi.yml
  - openapi/stedi-providers-api-openapi.yml
  - openapi/stedi-real-time-claim-status-api-openapi.yml
  - openapi/stedi-real-time-eligibility-check-api-openapi.yml
  - openapi/stedi-remittances-api-openapi.yml
  - openapi/stedi-tasks-api-openapi.yml
  - openapi/stedi-transactions-api-openapi.yml
  - openapi/stedi-x12-api-openapi.yml