Who this guide is for: You are developing a third-party app that your customers connect to mylab.
What you can build
Use API Connected Apps to let your customers connect their mylab accounts to your third-party app. After your customer signs in to mylab and approves access, your app can retrieve only the Hill Labs results that customer can access through mylab. Your app never receives a customer's mylab password.
API Connected Apps is read-only. Your app can retrieve results, but cannot submit orders or receive result push notifications.
Before you start
Before your customers can authorise your app, complete Hill Labs onboarding. Hill Labs must approve and register your third-party app and callback URL.
- Get the environment-specific authorisation URL, token endpoint, client ID, results scope, audience and API base URL through onboarding.
- Before your customer connects, make sure they have a mylab account. If they do not, ask them to register for mylab first.
After onboarding, build in this order
- Connect a customer in mylab, validate the callback and exchange the authorisation code using PKCE.
- Find and retrieve results by searching summaries, following pagination and requesting result details.
- Keep access working by refreshing tokens, reconnecting when needed and understanding how grant revocation works.
What a successful connection enables
Once your customer connects, you can list only the results they can access through mylab, retrieve a result by its result ID and request the latest result for a known LabSys job number. Hill Labs checks each request against that customer's active grant and mylab access. Your access token is tied to the customer who approved your app; you cannot request results under another customer's identity.
First step
Start with Connect a customer.
Need help with onboarding? Call +64 7 858 2000 or email cx@hill-labs.co.nz.