# clinic_token_required

> Only clinic tokens are accepted

- Status: 403 Forbidden
- Returned by: /api/public
- Operations: [createOrder](https://developers.rivr.io/reference/api-public/createOrder.md), [getOrder](https://developers.rivr.io/reference/api-public/getOrder.md), [getOrderStatus](https://developers.rivr.io/reference/api-public/getOrderStatus.md), [getOrderReceipt](https://developers.rivr.io/reference/api-public/getOrderReceipt.md), [refundOrder](https://developers.rivr.io/reference/api-public/refundOrder.md), [cancelOrder](https://developers.rivr.io/reference/api-public/cancelOrder.md), [sendOrderToDevice](https://developers.rivr.io/reference/api-public/sendOrderToDevice.md), [getDevices](https://developers.rivr.io/reference/api-public/getDevices.md), [getHealthSecure](https://developers.rivr.io/reference/api-public/getHealthSecure.md), [listMerchants](https://developers.rivr.io/reference/api-public/listMerchants.md), [getMerchant](https://developers.rivr.io/reference/api-public/getMerchant.md), [listOrderSettlements](https://developers.rivr.io/reference/api-public/listOrderSettlements.md), [getOrderSettlement](https://developers.rivr.io/reference/api-public/getOrderSettlement.md), [getNextUnreadSettlement](https://developers.rivr.io/reference/api-public/getNextUnreadSettlement.md), [createSubscription](https://developers.rivr.io/reference/api-public/createSubscription.md), [getSubscription](https://developers.rivr.io/reference/api-public/getSubscription.md)
- Retry (`retryWhen`): `after_fix`
- Did anything happen? (`outcome`): `none` (It did not happen)
- Access and organisation
- Page in the portal: https://developers.rivr.io/errors/clinic_token_required
- Try it: `GET https://developers.rivr.io/errors/simulate/clinic_token_required` answers with the code's exact wire form; `?succeedAfter=N&attempt=K` gives a 200 once `attempt` passes `N`

## What it means

The token comes from rivr-auth but isn't a clinic token, that is, not an organisation key exchanged for a clinic, for example a person's token. The partner endpoints of `/api/public` accept only clinic tokens from rivr-auth. `error` (`invalid_token`) and `error_description` stay in the body as before.

## What your system does

Call with the organisation key's token, or with the token you get with the clinic's client credentials.

## Is it worth retrying?

No, not without changing the call.

`retryWhen`: `after_fix`. Change the request first, as the code's page says: a value, the token, a header or a new key. Then send it.

## Did anything happen?

`outcome`: `none`. **It did not happen.** This call did not do what you asked for and changed nothing else that you can see or that concerns money. Where the code has an `outcomeNote`, it takes precedence.

## Example: /api/public

```http
HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "error": "invalid_token",
  "error_description": "Only clinic tokens from rivr-auth are accepted on the partner API.",
  "propertyName": null,
  "message": "Only clinic tokens from rivr-auth (organisation API keys) are accepted on the partner API.",
  "errorCode": "clinic_token_required",
  "code": "clinic_token_required",
  "type": "https://developers.rivr.io/errors/clinic_token_required"
}
```

The `title`, `detail`, `message` and `error_description` texts are exactly as the API writes them today.