simplepractice-fpx

SimplePractice Client Portal via curl (+ optional fpx)

The Client Portal is an Ember app whose backend is a plain JSON:API at https://<practice>.clientsecure.me/client-portal-api. It has no bot wall — every endpoint below answers ordinary server-side curl once you hold a session cookie. So this skill is curl-first; fpx appears only as an optional one-time way to lift the cookie out of a browser you're already signed into.

There is no password. Sign-in is passwordless: SimplePractice emails you either a magic link or a 6-digit PIN, and you trade that for a session cookie. That flow carries no captcha (reCAPTCHA guards only the new-client request, waitlist and contact forms), so §1 below works headlessly with nothing but curl and access to your inbox.

This is protected health information — your own therapy/medical record. Treat the cookie jar as a credential: it is a full-access bearer token for the portal. Keep it chmod 600, out of git, and off shared machines.

Your practice subdomain

Every URL is scoped to one practice. Take the host from the portal link your provider sent you and export it once:

export SP_HOST='achievebalancetherapy.clientsecure.me'   # <-- yours
export SP_API="https://$SP_HOST/client-portal-api"
export SP_JAR="$HOME/.simplepractice-cookies"

# curl creates a cookie jar world-readable (644). This one holds a live
# session for a medical record, so create it 0600 BEFORE curl ever writes it.
[ -e "$SP_JAR" ] || ( umask 077; : > "$SP_JAR" )
chmod 600 "$SP_JAR"

The four headers — all of them, on every call

sp() { curl -s -b "$SP_JAR" -c "$SP_JAR" \
  -H 'Api-Version: 2026-05-25' \
  -H 'Application-Build-Version: 0.0.0' \
  -H 'Application-Platform: web' \
  -H 'Accept: application/vnd.api+json' "$@"; }

Omit Application-Build-Version and the API rejects the call with 400 {"errors":[{"title":"Application build version is missing"}]} — verified. Api-Version is the API's own dated contract version, unrelated to any package version; send it as-is.