Connect assistants to safe clinic operations through MCP, or wire your own software into the scoped DoctoFam REST API and signed webhooks.
Model Context Protocol
Connect DoctoFam to Claude, ChatGPT, or another MCP client at https://mcp.doctofam.com/mcp. OAuth asks for the read-only doctofam:read scope and keeps every result inside the organization you authorize.
{
"mcpServers": {
"doctofam": {
"type": "http",
"url": "https://mcp.doctofam.com/mcp"
}
}
}The connector can review safe clinic metadata, open bookable capacity, provider and room display names, procedure-catalog names and prices, non-identifying calendar blocks, subscription entitlements, and aggregate schedule counts by UTC day. Its interactive views summarize the same bounded operational data.
The public MCP never returns patient identities or records, individual appointment records, diagnoses, treatments, prescriptions, histories, images, clinical notes, or other health data. It cannot create or change records and does not diagnose, triage, prescribe, recommend treatment, or make another medical decision.
Use the REST API below only when your own reviewed integration genuinely needs record-level access. REST API keys and their data-handling obligations are separate from the narrower MCP connector.
API keys
The Doctofam REST API is for your practice to build on its own data: sync patients with the software you already run, book appointments from your own website, push invoices and payments into your accounting, or feed a reporting tool. It is the same data the dashboard shows, reachable from your own code.
Create an API key in the Doctofam dashboard. The secret is shown once, when the key is created, and never again — store it somewhere safe. A key belongs to a single clinic, so the clinic is implied by the key and never has to be sent.
Authenticate every request with HTTP Basic auth carrying only the key secret, base64-encoded, in the Authorization header.
# The Authorization header is HTTP Basic auth carrying only the key secret,
# with no username and no colon.
Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)Every endpoint lives under https://api.doctofam.com. Requests made with a key are rate limited per key; going over the limit returns 429.
Patient records are medical data. Keep the key on a server you control, never in a browser or a mobile app, and give each integration its own key so one can be revoked without disturbing the others.
Quick start
List the patients of your clinic, register a new one, then read the appointments of a week.
# List the patients of the clinic the key belongs to
curl https://api.doctofam.com/api/patients \
-H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)"
# Register a new patient. The clinic is taken from the key, so it is never sent.
curl -X POST https://api.doctofam.com/api/patients \
-H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)" \
-H "Content-Type: application/json" \
-d '{
"name": "Maria Rossi",
"email": "maria.rossi@example.com",
"phone": "+391234567890"
}'
# Read this week's appointments, optionally narrowed to one patient
curl "https://api.doctofam.com/api/appointments?startTime=2026-01-01T00:00:00.000Z&endTime=2026-01-08T00:00:00.000Z" \
-H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)"Browse the full API reference — every endpoint with its parameters, request body, responses and required scope.
Reading a record that belongs to another practice answers 404, never 403, so ids cannot be probed from the outside.
CLI
The same clinics, patients, appointments, invoices, payments and procedures are available from your terminal through the doctofam CLI. Install it globally with npm, or run it ad hoc with npx.
Authentication is one command: doctofam login opens your browser to sign in to your DoctoFam account and stores a session for later commands. Headless scripts and agents export DOCTOFAM_API_KEY instead and skip the login step entirely.
# Install once, globally
npm install -g doctofam
# or run it ad hoc without installing
npx doctofam --help
# Log in — opens your browser to sign in and stores a session
doctofam login
# The clinics of your practice, with their ids
doctofam clinics list
# Find a patient, then read their upcoming appointments
doctofam patients list --email maria@example.com
doctofam appointments list --patientId PATIENT_ID --startTime 2026-08-01T00:00:00.000Z
# Book an appointment
doctofam appointments add --startTime 2026-08-10T14:00:00.000Z \
--endTime 2026-08-10T14:30:00.000Z --patientId PATIENT_IDEvery subcommand accepts --json for parseable output, and doctofam schema prints the whole command tree as JSON. The CLI reads and writes patient records, so keep it — and any API key it uses — on machines your practice controls.
The CLI is open source at github.com/doctofam/cli and published as doctofam on npm. Run any command with --help to see its options.
Agent Skills
DoctoFam ships Agent Skills — guides following the agentskills.io standard that teach coding agents how to drive the doctofam CLI and the MCP connector, instead of guessing at commands and tools.
# Install the DoctoFam skills into your coding agent
npx skills add doctofam/skillsOne command installs the skills into Claude Code, Cursor, Codex, Gemini CLI and any other agent that follows the Skills standard. The CLI also bundles the same guides, version-matched to the commands it ships: doctofam skills get <name> prints one on demand.
The two skills have deliberately different reach. The CLI skill drives the scoped REST API and can read and write patient records, so it belongs in your own practice tooling. The clinic-administration skill drives the read-only MCP connector and never touches patient identities, individual appointments or clinical data.
The skills are open source at github.com/doctofam/skills. Claude users can also install the DoctoFam Claude plugin, which bundles the connector together with the administrative skill: github.com/doctofam/claude-plugin.
Scopes
Each key carries a list of scopes, so a reporting tool that only needs to read your appointments never gets the ability to change a patient record. New keys start read-only; widen them explicitly in the dashboard. A request whose key is missing the scope an endpoint requires is refused with 403.
Webhooks
Add a webhook subscription to your clinic and Doctofam POSTs the events you picked to your server as they happen, whether the change came from the dashboard, from online booking or from the API itself.
POST https://your-server.com/doctofam-webhook
X-Doctofam-Event: appointment.created
X-Doctofam-Signature: t=1719000000,v1=<hmac-sha256 hex>
Content-Type: application/json
{
"event": "appointment.created",
"timestamp": 1719000000,
"data": { "...": "..." }
}Every delivery carries an X-Doctofam-Signature header of the form t=timestamp,v1=signature, where the signature is an HMAC-SHA256 of timestamp.body keyed by the subscription secret shown to you once when the subscription was created. Recompute it over the raw body and compare before trusting the payload.
import crypto from 'node:crypto'
// body must be the RAW request body, byte for byte
function verify(header, body, secret) {
const [t, v1] = (header || '').split(',').map(part => part.split('=')[1])
if (!t || !v1) return false
const expected = crypto
.createHmac('sha256', secret)
.update(`${t}.${body}`)
.digest('hex')
// timingSafeEqual throws on a length mismatch, so a malformed signature
// has to be rejected before the comparison rather than by it.
if (v1.length !== expected.length) return false
return crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))
}Delivery is one best-effort attempt with a five second timeout and no retries, so respond 2xx quickly and do the work asynchronously. An endpoint that fails twenty times in a row is disabled automatically and has to be re-enabled in the dashboard.
Start building