> ## Documentation Index
> Fetch the complete documentation index at: https://photonhealth.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Create the API credentials and webhooks your app and backend use.

Developers manage credentials and webhooks under **Settings → Developers**: [Neutron](https://app.neutron.health/settings/developers) · [Photon](https://app.photon.health/settings/developers).

Credentials come with every Neutron sandbox account. In production they come with [Launch and above](/docs/use-cases#plans-at-a-glance). Indie has none, because everything on Indie runs on the prescriber's own sign-in. If you can't see them on a paid account, ask your organization's administrator.

## API credentials

| | **Application** | **Backend** |
| - | - | - |
| What it is | A public `client_id` and a list of allowed URLs | A `client_id` and a `client_secret` |
| Used by | Prescribe's [React components](/docs/prescribe/embed/react), the [iframe](/docs/prescribe/embed/iframe) and the [JavaScript client](/docs/prescribe/embed/javascript) | Your backend, to get a [machine token](/docs/authentication#machine-tokens) |
| Signs in as | A prescriber, who can sign | Your organization, which can't sign |
| Keep it | In your frontend. It's public. | On your server, out of client-side code and version control |

See [Authentication](/docs/authentication) for the tokens each one gets.

### Allowed URLs

An Application credential only works on the domains in its allowed URLs. Add:

* Every domain your app runs on, including `http://localhost:5173` or wherever you develop
* Every domain that shows the [iframe](/docs/prescribe/embed/iframe)
* The Prescribe app's domain: `rx.neutron.health`, or `rx.new` in production

### Rotate a secret

If a `client_secret` leaks, rotate it under **Developers**, then update your backend.

### MCP clients

To let another MCP client, such as a scribe, act for a prescriber, it must be allowlisted on your Application credential. Ask your Photon contact. See [Connect a client](/docs/network/mcp/connect).

## Webhooks

Webhooks tell your backend when prescriptions and orders change. Add one under **Developers** with an HTTPS URL, the events you want and a shared secret. See [Webhooks](/docs/network/webhooks#subscribe).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.