HL7 FHIR Authentication. SMART APP LAUNCH IMPLEMENTATION GUIDE v2.2.0 - foundational FHIR-based OAuth 2.0 / OAuth 2.1 + OpenID Connect framework + standardised app authorization. 3 LAUNCH MODES: (a) EHR-LAUNCH (SMART App in context of EHR with patient + user context); (b) STANDALONE-LAUNCH (SMART App initiated by user/patient); (c) BACKEND SERVICES LAUNCH (server-to-server + asymmetric key + system-level scopes). KEY OAUTH 2.0/2.1 + OPENID CONNECT FLOWS: (1) Authorization Code Grant + PKCE (Proof Key for Code Exchange) - required for public clients; (2) Backend Services - asymmetric key (JWT Bearer Token) for confidential clients + server-to-server; (3) Client Credentials Grant - rare in healthcare; (4) Refresh Tokens - long-lived sessions; (5) Resource Owner Password (DEPRECATED). PKCE: code_verifier + code_challenge_method=S256 (S256 + plain); prevents authorization code interception attacks; MANDATORY for SMART Standalone-Launch. OPENID CONNECT - identity layer on top of OAuth 2.0 + ID token + UserInfo endpoint + JWKS + scopes (openid + profile + email); FHIR-SEC-04. USER AUTHENTICATION (FHIR-SEC-2.1) - OAuth-token based + Multi-factor Authentication (MFA) + biometric + risk-based + adaptive + customer journey + customer protection; coordinates with hospital/EHR user authentication + SSO (SAML + OIDC); ID Token + claims. SYSTEM-TO-SYSTEM AUTHENTICATION (FHIR-SEC-2.3 + FHIR-SEC-05) - Backend Services Authentication + asymmetric key (RS256/ES256) + JWT Bearer Token + JWKS publication + scope-based authorization; SMART Backend Services IG; mTLS optional; ideal for EHR-to-EHR + payer-provider + 3rd-party. TOKEN LIFETIME + REFRESH (FHIR-SEC-18) - short-lived access tokens (typically 5-60 minutes) + refresh tokens (longer-lived + bound to user/client) + secure storage + revocation + token introspection; OAuth 2.0 RFC 7009 + RFC 7662; manage token lifecycle + sliding window + offline-access scope. KEY EVIDENCE: SMART IG compliance + OAuth flows + PKCE implementation + ID token + JWKS + token endpoint security + refresh token storage.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.