# HealthSherpa ❮ONE❯ Developer Portal Login and Key Management

> Passwordless portal flow for requesting a login link, managing API keys, and requesting approval-gated enrollment access.

## Unauthenticated flow

- Developers request a one-time login link using the same email used for registration.
- If a login link is available for that email, the portal sends one shortly.
- Email verification and approval must already be complete before a portal session is issued.

## Authenticated actions

- Generate an API key
- Reveal a pending API key once
- Confirm that the new key has been stored
- Test current public endpoints from the built-in API explorer
- Contact support from the portal
- Sign out of the current portal session

## Approval-gated access requests

- Submitted requests show whether review is pending, approved, or not approved.
- Approval decision timestamps are shown when available; legacy approvals without a timestamp still show the correct decision.
- Approved requests show setup separately from the decision:
  - On-exchange lists **Consumer self-service** and optional **Agent-assisted** enrollment as alternative flows, not sequential steps.
  - Off-exchange shows one **Account setup** state for the Off-Exchange Enrollment API.
- User-facing setup states are **Setup complete**, **Setup in progress**, **Action required**, **Contact support**, and **Refresh needed**.
- **Action required** tells the developer to connect or reconnect their HealthSherpa Marketplace account through the existing OAuth linking flow. Developers who only use consumer self-service do not need to complete that action.
- If Marketplace OAuth linking is disabled or unavailable, the agent-assisted recovery state routes the developer to support instead of linking to a hidden reconnect control.
- API requests are still authorized at runtime.

### On-Exchange Enrollment

- Developers can submit a freeform reason for requesting on-exchange enrollment access.
- HealthSherpa Marketplace must be linked first; the request button stays disabled until the account is linked.
- Review is required so HealthSherpa can confirm the on-exchange enrollment experience meets regulatory requirements before access is enabled.
- Approved developers can link HealthSherpa Marketplace from the portal without submitting this request first.

### Off-Exchange Enrollment API

- Developers can submit a freeform reason for requesting off-exchange enrollment access.

## Contact support

- Developers can submit a support question from the authenticated portal.
- The form collects only the question.
- The server includes name and email from the authenticated developer record.
- Submissions are limited to one accepted request per developer per hour.

## Security notes

- Login uses a one-time email link.
- Portal sessions are short-lived.
- Newly provisioned keys are intended to be copied and stored immediately.