Cliniko: use Abe separately or verify the integration
Who this is for
This guide is for an authorised practice or hospital arranging non-patient reference access alongside Cliniko. The integration route remains unavailable: this guide records a route to pursue, not an accepted Abe installation or vendor partnership. Fees are unconfirmed and require a current written contract for the chosen purpose.
The recorded API route uses a server-held user API key with that key owner’s permissions. A key is not a browser credential, an Abe personal login or evidence that Cliniko provides an OAuth or iframe route for this use.
Start here
- Record the exact product, version, practice or hospital, intended reference purpose and authorised contact. Do not put patient details or credentials in the request.
- While integration is gated, sign in to Abe separately. Use Professional development or Evidence search within your own current access. This companion does not connect the vendor or exchange patient data.
- Confirm the key owner, account mapping, permitted endpoints and vendor terms. Store the key only in the authorised server environment, establish the separately verified Abe person and arrange the vendor-supported rotation and revocation process.
- Agree source permission for the exact audience and representation. Permission to open a source link does not establish permission to copy its full body into a panel or redistribute it.
- Arrange the acceptance witness below and name the support owner. Payment, application registration and human consent are separate from vendor acceptance.
What success looks like
The standalone companion reaches the correct Abe account and permitted reference result. The proposed integration route is server-held user API key, and it can be called accepted only after the exact environment and contract have a witnessed result.
Witness the exact Cliniko account and Abe person, allowed scope and forbidden-scope denial. Switch user and account, rotate the key, test expiry and revoke. Ensure old access fails rather than silently choosing another person’s key.
The acceptance record must show the actual product/version, practice, identity, scope, source use, expiry and revoke outcome. Patient reads and writes remain disabled under this reference scope, even if a vendor API offers them. Sponsoring a person does not expose their private alert criteria or make a practice credential that person's identity.
If it does not work
If identity or scope mapping is uncertain, stop the integration and use Abe separately. Do not paste the key into a browser, help ticket or chat, and do not invent an OAuth flow.
Stop if a reference opens under the wrong person or site, or a source has no current permission. Send support the product/version, intended non-patient task and safe error only. Do not send keys, patient information or screenshots containing either. Use Troubleshooting for failures in the existing companion; it cannot replace missing vendor acceptance.
Stop or change your choices
Before accepting an integration, witness what happens when you switch user, account or site. Disconnect the affected Abe host permission through its supported process and revoke the vendor credential, pairing or launch permission through the separately confirmed vendor process. Verify old access is denied; if that process is not known or cannot be witnessed, the integration route stays unavailable.
Revocation prevents new authorised uses; an already delivered reference or in-flight operation cannot be recalled by disconnecting. Keep independently valid direct Abe access, personal preferences and funding separate. Manage and cancel explains those separate choices. Reconnecting later requires current authority and renewed acceptance where the contract or environment changed.
Recorded source: Cliniko vendor documentation. Obtain current written confirmation before activation; the recorded documentation is not a fee quote or proof that Abe has been accepted.