MindFlow is built as an open platform: every major integration uses a configurable credential (not a hardcoded key), all outbound calls are logged, and a plugin API allows adding new integrations without modifying the core application.
OAuth2, storing tokens in user_google_tokens. Bi-directional sync: app → GCal (push on create/update/cancel) and GCal → app (blocked slots read on every availability check). api/gcal_oauth_callback.php handles the OAuth callback; api/google_calendar.php handles event CRUD.
Cal.com API v2 integration (api/calcom.php). For clinics using Cal.com as their primary booking page. User-level Cal.com credentials in user_calcom_tokens. Blocked slots mirrored in calcom_blocked_slots to prevent double-booking.
Slot availability queries combine all three sources (native schedule + gcal_blocked_slots + calcom_blocked_slots) in a single SQL UNION — no race condition between independent sync cycles.
Twilio REST API v2. Credentials: Account SID, Auth Token, sender number (stored in app_settings). Outbound only. Status callback support for delivery tracking. See Communications detail page for full spec.
WhatsApp Business API (provider-agnostic — Twilio, D7, etc.). Template-based outbound only. See Communications detail page for full spec.
Telegram Bot API. Primarily for document delivery (prescriptions, lab reports as PDFs) to patients who have opted in. See Communications detail page for full spec.
Zoom Server-to-Server OAuth. Used for telehealth video sessions. Webhook-driven status sync. See Video Visits detail page for full spec.
Used for session recording transcription and VoxRx. Server-side proxy at api/sarvam_transcribe.php. Supports Hindi, Punjabi, Tamil, Telugu, Kannada, Malayalam, and English. Falls back to a local Whisper-based transcription (includes/sarvam_local_transcribe.php) if the Sarvam API is unreachable.
Any OpenAI-compatible endpoint. Multi-provider fallback: hoster key → clinic's own keys in priority order. See AI Assistance detail page for full spec.
api/lab_reports.php uses OCR.space to extract text from scanned lab report images (JPEG/PNG/PDF) uploaded by patients or staff. Falls back to OCR.space's public rate-limited demo key if no paid key is configured — so the feature works out of the box, with rate limits.
OAuth2 client credentials flow, tokens cached in-process. Used for live diagnosis code search in clinical notes. Can be plan-included (hoster provides client ID/secret) or clinic-configured. See Patient Records detail page for full ICD-11 spec.
PayU REST API for card, UPI, net banking. Redirect flow (pages/payment_process.php → PayU → pages/payment_return.php + api/payu_webhook.php for async confirmation). HMAC webhook verification.
PayPal Express Checkout redirect flow for international payments. actions/paypal_return.php handles the callback.
Shiprocket REST API v1. Shipment creation, AWB number retrieval, and tracking updates via api/shiprocket_webhook.php. Credentials in app_settings.
Unsplash API for the store's product-image picker. Key can be hoster-supplied (plan-included) or clinic-provided. api call proxied via includes/store.php → storeUnsplashSearch(). No direct browser-to-Unsplash calls.
REST/JSON API documented endpoints for patient records, appointments, and billing — authenticated via API key (stored in app_settings). All calls logged in external_api_logs. Rate limiting configurable per key.
plugins/*/plugin.json manifest + includes/plugin_loader.php + includes/hooks.php. Plugins can register: settings panels, nav items, API handlers (/api/plugin/[slug]/), and cron jobs. The plugin page (pages/plugins.php) lists installed plugins with enable/disable toggle.
All inbound webhooks (PayU, Shiprocket, Zoom, Telegram) follow the same pattern: signature/token verification → log raw payload to external_api_logs → parse → update database → return 200. A 200 response is always returned quickly; processing is synchronous but fast, to avoid gateway retries.
The demo has real sample data — appointments, patients, prescriptions — so you can explore freely.