Medicrest API

Bill a customer's medical insurer straight from your storefront. Create a checkout, let the customer confirm their cover, and get paid — with webhooks telling you exactly what happened.

Authentication

Three ways to call the API, one per audience. Set your base URL and (optionally) an API key in the top bar to make the Try it panels live.

X-API-Key

Storefront

Server-to-server. Send X-API-Key on every request. Staff-level access.

mc_session cookie

Dashboard users

People sign in via /api/auth/login. Role decides what they can do.

checkout token

Customers

The token in the checkout URL is the credential for that one session — no key or cookie.

Roles for dashboard users

adminEverything, plus user management.

staffThe whole claims desk: eligibility → submit, checkouts, lifecycle, settings, webhooks.

agentInsurance agent — sees, adjudicates and records payments only for the insurers assigned to them.

Quickstart — “Pay with insurance”

The storefront creates a session, redirects the customer to the hosted page, and reacts to a webhook. Full guide in the dashboard · docs/storefront-integration.md.

Webhooks

Medicrest POSTs events to MEDICREST_WEBHOOK_URL (and any per-order webhook_url), signed with X-Medicrest-Signature. Retries 3× (0s, 2s, 10s).

Events

Verify the signature

Payload