Getting started

Use this quickstart to take a new server-side integration from an empty project to a valid Waspito access token. You should be able to complete the core flow in about 10 minutes once your developer account is approved.

Important: Waspito client secrets and access tokens are backend credentials. Never embed them in browser JavaScript, a mobile application, a public repository, or a URL shared with a patient.

What you will accomplish

By the end of this guide, you will have:

1. A registered application in the Developer Console.
2. A safely stored client ID and client secret.
3. A temporary developer access token.
4. A clear path to the protected endpoint documentation.

Before you begin

Use the Developer sign in action in the documentation header. After signing in, open Apps in the Developer Console and create an application.

When the application is created, copy both credential values immediately. The client secret is presented once; Waspito stores only its hash afterward.

1. Configure your environment

Store credentials in your deployment platform's secret manager. For local development, use an ignored environment file.

WASPITO_API_BASE_URL=https://app.waspito.com/api/v1/icers-bridge/ehealth-access
WASPITO_CLIENT_ID=YOUR_CLIENT_ID
WASPITO_CLIENT_SECRET=YOUR_CLIENT_SECRET

Confirm that .env and equivalent secret files are excluded from version control before continuing.

2. Generate an access token

Send the application credentials to the public token endpoint:

curl --request POST \
  'https://app.waspito.com/api/v1/icers-bridge/ehealth-access/oauth/token' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

A successful request returns HTTP 200 with a temporary token:

{
  "data": {
    "access_token": "YOUR_TEMPORARY_ACCESS_TOKEN",
    "token_type": "Bearer",
    "expires_at": 43200,
    "scopes": "generate-call-link,make-call"
  },
  "status": true,
  "message": "Access token generated with success.",
  "code": "_WT_201"
}

The response code is Waspito's application-level code; the HTTP response status is 200. Calculate your local token expiry from the returned expires_at duration and refresh before the next protected request when necessary.

For every field, error response, and lifecycle rule, read Generate an access token.

3. Keep the token server-side

Use the returned value in the standard Bearer header:

Authorization: Bearer YOUR_TEMPORARY_ACCESS_TOKEN

Recommended storage depends on your architecture:

Do not store the plaintext token in analytics, exception reports, request logs, or database audit messages.

4. Continue to protected APIs

Protected endpoint pages are intentionally excluded from anonymous navigation and search. Sign in with the developer account associated with your application; the additional page will appear as its own menu item.

If you open a protected documentation URL while signed out, Waspito sends you through developer sign-in and preserves the page you intended to visit.

Verify your setup

Your integration is ready for the next step when all of the following are true:

• The token request returns status: true.
• data.token_type is Bearer.
• data.expires_at is greater than zero.
• The client secret is absent from source control and application logs.
• Your backend can attach the Authorization header without exposing it to the client.

Common setup problems

Where to go next

• Understand the contract in API overview.
• Review the complete access-token endpoint.
• Use the integration checklist before production rollout.