Hi. We are building a multi-tenant practice platform on hosted Medplum, and spoke with Reshma on the 24th. One blocking question. Our front door is a public booking page with no account required. Tested against api.medplum.com on 2026-09-20: Appointment/$find, Appointment/$book and Schedule all return 401 to a visitor with no token, and a public page cannot hold a client secret. What is the recommended pattern? - a Bot behind an unauthenticated HTTP endpoint that calls find and book for the visitor. Is that supported on hosted, and how would we rate-limit it? - our own small server holding client credentials under a narrow access policy? - or something built in that we have missed? Two related things. Does $book reject a slot another visitor has already taken, or is there a hold operation we should use? And which resource should carry a deposit payment reference taken before the appointment is confirmed? Until this is settled our booking app runs on a stub calendar, so an answer unblocks real work. Happy to share the project id in a DM. Thanks.

I'm no Medplum expert but on your first question, AFAIK #2 is the correct pattern. We have implemented #1 in the past using a public webhook bot (https://www.medplum.com/docs/bots/consuming-webhooks#how-to-set-up-an-unauthenticated-webhook) out of convenience for a small project and it works nicely but it's self-hosted and to your point, we have a dedicated proxy in front of it for rate limits and CORS headers etc. From the Medplum docs I don't think public webhook bots are really intended for this use case and I'm not aware of anything else that does the job.