FAQs

Our integration is manual today, but we want automatic activations. How do we switch?

Ship the full InstantOn OAuth flow so practices can authorize directly from Hint. Once your InstantOn implementation is tested, email [email protected] and we will validate it in staging before enabling automatic activations for every connected practice.

Where can I see the list of webhook events?

Review the canonical list in Webhooks. Each entry includes the event name and payload so you can map it to your handlers quickly.

Do practice access tokens expire? Can we refresh them?

Hint-issued practice tokens do not expire automatically and cannot be refreshed. A practice can disable your integration at any time, which invalidates that specific token immediately. We can also revoke a token on request if you need to rotate credentials.

All practices share the same multi-tenant instance of our app. Do we still need unique per-practice IDs?

Yes. Each practice activates its own connection, so every credential is scoped to a single practice. Use the installation id (and practice.id) returned by POST /api/partner/installations/connect to correlate activity on your side.

Which endpoints require the partner API key vs. the practice access token?

Partner-level endpoints -- everything under /api/partner/* -- always require the Partner API key. Practice-scoped endpoints under /api/provider/* require the practice-specific access token issued when a practice activates its connection. The overview explains how the partner and provider namespaces split responsibilities.

Can we pull richer practice metadata (specialties, education, etc.)?

Those fields are not currently exposed. Send feature requests with the use case to [email protected] so we can prioritize them appropriately.

A practice user says our app shows "You don't have access". What happened?

The user is missing access to your product, or missing a Partner Role for it.

If the message is Hint's, the user has no access record for your product. Hint stops the surface load with a 403, and your handshake URL is never called.

If the message is your app's, the user has access but no Partner Role your app declares, so the handshake arrived with an empty partner_roles array.

A practice admin fixes both the same way: open Marketplace, open your product, then the Manage Users tab, add the user if they are missing, and pick a Partner Role. A user who has access but no role shows as N/A in that column. See Roles & Access Context for more.

How are partners notified when a practice terminates an integration?

We send an integration.deactivated webhook as soon as the practice disconnects. Ensure your webhook receiver is resilient and validates signatures.