Every call to the Doctavian API is authenticated with a small set of HTTP headers. Most platforms use a single API key or bearer token; Doctavian uses a few headers because one request can carry three independent pieces of information: which API you are calling, who is making the call, and — for async operations — where the result should be delivered.
Get those headers right and your call succeeds. This page lists them; the other pages show you exactly what to send and how to build each one.
| Header | Required | Purpose |
|---|---|---|
x-api-key | Always | Identifies the API version and environment you are calling. |
Authorization | Always | Standard OAuth 2.0 bearer token from Microsoft or Google. Identifies who is calling. |
x-client-authorization | Async only | Signed + encrypted token describing the callback Doctavian should make when an async operation finishes. |
x-api-keyis scoped to a single API version and environment. Sending the wrong one returns401 Unauthorized - ApiKeyInvalid.
If a header is missing, malformed, expired, or wrongly built, the call fails with a specific error that points straight at the header at fault — see Troubleshooting.
Most integrations use the standard OAuth 2.0 Authorization Code flow through the Doctavian auth proxy:
GET https://{{baseUrl}}/platform/auth/{provider}/authorize
POST /platform/auth/{provider}/tokenReplace <provider> with microsoft or google. Applications calling on their own behalf (no interactive user) use the client credentials flow instead.
If you are testing with the Postman collection, you don't build this flow yourself — Postman's built-in OAuth 2.0 support runs the browser login for you. See the Quickstart.