Athelas · Authentication Profile

Athelas Authentication

Authentication

Athelas secures its APIs with http and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, and refreshToken flow(s).

CompanyHealthcareRemote Patient MonitoringElectronic Health RecordsFHIRRevenue Cycle ManagementMedical DevicesSMART on FHIRInteroperabilityAI
Methods: http, oauth2 Schemes: 2 OAuth flows: authorizationCode, clientCredentials, refreshToken API key in:

Security Schemes

bearerAuth http
scheme: bearer
smartOnFhir oauth2
· flows: authorizationCode, clientCredentials, refreshToken

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-18'
method: searched
source: openapi/athelas-enterprise-openapi.yml
docs:
- https://athelas.readme.io/docs/authentication
- https://docs.athelas.com/air_developer/fhir_api/commure_ehr_fhir_api
summary:
  types:
  - http
  - oauth2
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - refreshToken
schemes:
- name: bearerAuth
  api: Athelas Enterprise API
  type: http
  scheme: bearer
  description: >-
    Bearer token for the Athelas Enterprise RPM API. Obtain a token by POSTing email
    and password to /auth/login (production https://api.athelas.com/enterprise/v1,
    staging https://staging-api.athelas.com/enterprise/v1). Tokens expire after 60
    minutes and must be renewed by repeating the login. Sent as
    Authorization: Bearer <token>.
  sources:
  - openapi/athelas-enterprise-openapi.yml
  docs: https://athelas.readme.io/docs/authentication
- name: smartOnFhir
  api: Commure EHR FHIR API
  type: oauth2
  description: >-
    SMART on FHIR v2 (ONC §170.215(a)(3)) using AWS Cognito as the identity provider.
    Access tokens are sent as Authorization: Bearer <token> on all FHIR requests.
    Supports standalone launch, EHR launch, and Backend Services (bulk data)
    authorization. Token endpoint auth methods: none (PKCE), client_secret_post,
    client_secret_basic, private_key_jwt. PKCE S256 required for public clients.
    Refresh tokens issued only with offline_access scope; confidential-client tokens
    valid a minimum of 3 months.
  issuer: https://cognito-idp.us-east-2.amazonaws.com/us-east-2_KudjXF579
  jwks_uri: https://cognito-idp.us-east-2.amazonaws.com/us-east-2_KudjXF579/.well-known/jwks.json
  well_known: https://onc.api.staging-ehr.athelas.com/.well-known/smart-configuration
  flows:
  - flow: authorizationCode
    authorizationUrl: https://onc.api.staging-ehr.athelas.com/authorize
    tokenUrl: https://onc.api.staging-ehr.athelas.com/token
    pkce: S256
  - flow: clientCredentials
    tokenUrl: https://onc.api.staging-ehr.athelas.com/token
    client_assertion: private_key_jwt
    note: Backend Services Authorization (bulk data / system-level)
  - flow: refreshToken
    tokenUrl: https://onc.api.staging-ehr.athelas.com/token
  introspection_endpoint: https://onc.api.staging-ehr.athelas.com/introspect
  revocation_endpoint: https://onc.api.staging-ehr.athelas.com/revoke
  scopes_ref: scopes/athelas-scopes.yml
  docs: https://docs.athelas.com/air_developer/fhir_api/commure_ehr_fhir_api