Infermedica Authentication: API Access & Security (2026)

Authentication overview

Infermedica's API platform provides access to its medical knowledge base and diagnostic reasoning engine, enabling integration into digital health applications, triage solutions, and call center support systems. To ensure secure and authorized access, Infermedica primarily employs API key authentication. This mechanism requires client applications to present a unique set of credentials with each API request, allowing the Infermedica platform to verify the identity and permissions of the caller before processing the request. This approach is standard for many web APIs, balancing ease of use for developers with necessary security controls for sensitive healthcare data.

The authentication process is critical for maintaining the integrity and privacy of health-related information, aligning with compliance standards such as HIPAA and GDPR. Developers integrating with Infermedica's API must properly manage and transmit these credentials to prevent unauthorized access and data breaches. Infermedica provides comprehensive API documentation detailing the specific headers and values required for successful authentication, ensuring a clear path for secure integration.

Supported authentication methods

Infermedica's API relies on API key authentication, a common method for securing access to web services. This involves two primary headers that must be included in every API request:

• App-Id: Identifies your application.
• App-Key: Serves as the secret key associated with your application ID.

These keys collectively act as the credentials for your application, verifying its identity and authorization to interact with the Infermedica API. This method is suitable for server-to-server communication where the keys can be securely stored and managed. For client-side applications, careful consideration must be given to prevent exposure of these keys.

Comparison of authentication methods

While Infermedica's primary method is API keys, understanding its position relative to other common authentication schemes can be helpful:

Infermedica's choice of API keys aligns with its focus on enterprise integrations, where applications typically operate in controlled environments. For more complex user-delegated authorization scenarios, methods like OAuth 2.0 offer a robust framework for managing access without exposing user credentials directly to third-party applications. However, for direct application-to-API communication, API keys provide a straightforward and effective security measure when implemented correctly.

Getting your credentials

Access to Infermedica's API, and consequently its authentication credentials, typically begins with an enterprise partnership. Infermedica focuses on custom enterprise pricing and solutions, indicating that API access is not generally provided through a self-service signup for individual developers.

1. Contact Sales: The initial step is to contact Infermedica's sales team to discuss your specific use case and integration needs. This engagement helps determine if Infermedica's API platform is suitable for your project and initiates the process for evaluation access.
2. Evaluation Access: Infermedica offers evaluation access, which includes the necessary API credentials (App-Id and App-Key) for testing and development purposes. This access is typically granted after a consultation and agreement on terms.
3. Developer Portal: Once evaluation access is granted, you will likely receive instructions on how to access Infermedica's developer portal. This portal is the central hub for managing your API keys, accessing detailed API documentation, and potentially monitoring your API usage.
4. Production Credentials: For production deployments, a formal agreement and potentially a dedicated account manager will guide you through obtaining production-ready API keys. These keys often have higher rate limits and are designed for live application environments.

It is crucial to treat your App-Id and App-Key as sensitive information. They should never be hardcoded directly into client-side code, exposed in public repositories, or shared unnecessarily. Secure storage and environment variable usage are highly recommended practices.

Authenticated request example

To make an authenticated request to the Infermedica API, you must include your App-Id and App-Key in the HTTP headers. The following example demonstrates a typical API call using JavaScript, a language for which Infermedica provides SDK support. This example assumes you have obtained valid credentials for an evaluation or production environment.

const API_BASE_URL = 'https://api.infermedica.com/v3/';
const APP_ID = 'YOUR_APP_ID'; // Replace with your actual App-Id
const APP_KEY = 'YOUR_APP_KEY'; // Replace with your actual App-Key

async function getSymptoms() {
  try {
    const response = await fetch(`${API_BASE_URL}symptoms`, {
      method: 'GET',
      headers: {
        'App-Id': APP_ID,
        'App-Key': APP_KEY,
        'Content-Type': 'application/json'
      }
    });

    if (!response.ok) {
      throw new Error(`HTTP error! Status: ${response.status}`);
    }

    const data = await response.json();
    console.log('Symptoms:', data);
  } catch (error) {
    console.error('Error fetching symptoms:', error);
  }
}

getSymptoms();

In this example, the fetch API is used to make a GET request to the /symptoms endpoint. The critical part is the headers object, where App-Id and App-Key are set with your specific credentials. Always ensure that these values are securely managed and not exposed in client-side code that could be inspected by users. For production applications, these credentials should be stored in environment variables or a secure configuration management system and accessed server-side.

Security best practices

Integrating with the Infermedica API, particularly given its role in healthcare, necessitates adherence to robust security practices. Protecting your API keys and ensuring the integrity of data transfers are paramount for compliance and user trust.

1. Secure Key Management

• Environment Variables: Store your App-Id and App-Key as environment variables on your server or in a secure configuration management service. Avoid hardcoding them directly into your application's source code, especially for client-side applications.
• Never Expose Client-Side: API keys should never be exposed in client-side code (e.g., JavaScript in web browsers or mobile app binaries) where they can be easily extracted by malicious actors. All API calls requiring authentication should originate from your secure backend server.
• Rotate Keys: Periodically rotate your API keys. This practice minimizes the risk associated with a compromised key, as the old key will eventually become invalid. Consult Infermedica's developer portal or support for key rotation procedures.
• Access Control: Implement strict access controls for who can view or modify API keys within your organization. Use secret management tools where appropriate.

2. Data Protection in Transit and at Rest

• HTTPS/TLS: Always use HTTPS for all API communications. Infermedica's API endpoints are served over HTTPS, ensuring that all data exchanged between your application and the API is encrypted during transit. This prevents eavesdropping and tampering. The Transport Layer Security (TLS) protocol, which HTTPS relies on, is fundamental for secure web communication.
• Input Validation: Validate all data sent to the Infermedica API to prevent injection attacks or malformed requests that could exploit vulnerabilities.
• Output Sanitization: Similarly, sanitize and validate any data received from the Infermedica API before displaying it to users or processing it, to mitigate risks like cross-site scripting (XSS).

3. Compliance and Auditing

• HIPAA and GDPR: Given Infermedica's healthcare domain and compliance with HIPAA and GDPR, ensure your application's data handling practices also adhere to these regulations, especially concerning personal health information (PHI) and personally identifiable information (PII).
• Logging and Monitoring: Implement comprehensive logging for all API requests and responses. Monitor these logs for unusual activity, failed authentication attempts, or potential security incidents. Alerting systems can help detect and respond to threats promptly.
• Rate Limiting: While Infermedica's API likely has its own rate limiting, consider implementing client-side rate limiting to prevent abuse of your application's access to the API, which could lead to service interruptions or unexpected costs.

4. Least Privilege Principle

• Minimal Permissions: If Infermedica offers different types of API keys with varying permissions, always use the key with the minimum necessary permissions required for your application's functionality. This limits the damage if a key is compromised.

By diligently applying these best practices, developers can build secure and compliant integrations with the Infermedica API, safeguarding sensitive health data and ensuring reliable service operation.