Partner apps are provisioned manually. Email support@everbility.com to register as a partner and receive your
client_id and client_secret.How it works
The three building blocks
Connection
A practice admin approves your app once. You exchange the authorization code for tokens and refresh them on a 90-day rolling window.
Launch session
A single report-writing hand-off. You create it with a clinician email and your client ID, then send the clinician to the
launch_url.Document retrieval
Poll the session until it completes, then pull the rendered report as Markdown or HTML into your platform.
Base URL
Client mapping
Your platform and Everbility each have their own client records. The first time a clinician opens a session for one of your clients, Everbility asks them to link it to an Everbility client (or they create one). The mapping is remembered per connection, so every later session for thatexternal_client_id skips straight to writing.
Lifetimes at a glance
| Credential / object | Lifetime | Notes |
|---|---|---|
| Authorization code | 5 minutes | Single use. A new approval invalidates any outstanding codes. |
| Access token | 1 hour | Opaque bearer token for all partner endpoints. |
| Refresh token | 90 days | Single use — each refresh returns a new pair (rotation). |
| Launch session | 48 hours | Expires if the clinician does not complete the report in time. |
Security model
- PKCE is mandatory. Every authorization uses
code_challenge_method=S256, in addition to yourclient_secret. - Tokens are opaque and hashed at rest. Everbility stores only SHA-256 hashes of codes, tokens, and your client secret.
- Refresh tokens rotate. Reusing an already-consumed refresh token revokes the whole token family and flags the connection for re-authorization.
- Clinicians use their own login. Your platform never handles Everbility user credentials; sessions are bound to a specific clinician by verified email.
Start here
Get credentials
Email support@everbility.com with your redirect URI to receive a
client_id and client_secret.Connect a practice
Send a practice admin through the consent flow and exchange the code for tokens.
Launch and retrieve
Create a launch session, hand the clinician the
launch_url, and poll for the finished document.