Athelas · Authentication Profile

Athelas Authentication

Authentication

Athelas secures its APIs with http and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, and refreshToken flow(s).

CompanyHealthcareRemote Patient MonitoringElectronic Health RecordsFHIRRevenue Cycle ManagementMedical DevicesSMART on FHIRInteroperabilityArtificial Intelligence
Methods: http, oauth2 Schemes: 2 OAuth flows: authorizationCode, clientCredentials, refreshToken API key in:

Security Schemes

bearerAuth http
scheme: bearer
smartOnFhir oauth2
· flows: authorizationCode, clientCredentials, refreshToken

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-18'
method: searched
source: openapi/athelas-enterprise-openapi.yml
docs:
- https://athelas.readme.io/docs/authentication
- https://docs.athelas.com/air_developer/fhir_api/commure_ehr_fhir_api
summary:
  types:
  - http
  - oauth2
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - refreshToken
schemes:
- name: bearerAuth
  api: Athelas Enterprise API
  type: http
  scheme: bearer
  description: >-
    Bearer token for the Athelas Enterprise RPM API. Obtain a token by POSTing email
    and password to /auth/login (production https://api.athelas.com/enterprise/v1,
    staging https://staging-api.athelas.com/enterprise/v1). Tokens expire after 60
    minutes and must be renewed by repeating the login. Sent as
    Authorization: Bearer <token>.
  sources:
  - openapi/athelas-enterprise-openapi.yml
  docs: https://athelas.readme.io/docs/authentication
- name: smartOnFhir
  api: Commure EHR FHIR API
  type: oauth2
  description: >-
    SMART on FHIR v2 (ONC §170.215(a)(3)) using AWS Cognito as the identity provider.
    Access tokens are sent as Authorization: Bearer <token> on all FHIR requests.
    Supports standalone launch, EHR launch, and Backend Services (bulk data)
    authorization. Token endpoint auth methods: none (PKCE), client_secret_post,
    client_secret_basic, private_key_jwt. PKCE S256 required for public clients.
    Refresh tokens issued only with offline_access scope; confidential-client tokens
    valid a minimum of 3 months.
  issuer: https://cognito-idp.us-east-2.amazonaws.com/us-east-2_KudjXF579
  jwks_uri: https://cognito-idp.us-east-2.amazonaws.com/us-east-2_KudjXF579/.well-known/jwks.json
  well_known: https://onc.api.staging-ehr.athelas.com/.well-known/smart-configuration
  flows:
  - flow: authorizationCode
    authorizationUrl: https://onc.api.staging-ehr.athelas.com/authorize
    tokenUrl: https://onc.api.staging-ehr.athelas.com/token
    pkce: S256
  - flow: clientCredentials
    tokenUrl: https://onc.api.staging-ehr.athelas.com/token
    client_assertion: private_key_jwt
    note: Backend Services Authorization (bulk data / system-level)
  - flow: refreshToken
    tokenUrl: https://onc.api.staging-ehr.athelas.com/token
  introspection_endpoint: https://onc.api.staging-ehr.athelas.com/introspect
  revocation_endpoint: https://onc.api.staging-ehr.athelas.com/revoke
  scopes_ref: scopes/athelas-scopes.yml
  docs: https://docs.athelas.com/air_developer/fhir_api/commure_ehr_fhir_api

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/athelas-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.