Devoted Health · Authentication Profile

Devoted Health Authentication

Authentication

Devoted Health secures its APIs with oauth2 and openIdConnect across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

CompanyHealthcareHealth InsuranceMedicare AdvantageFHIRInteroperabilityPatient AccessProvider DirectoryDrug FormularyCMSHL7SMART on FHIR
Methods: oauth2, openIdConnect Schemes: 2 OAuth flows: authorizationCode API key in:

Security Schemes

SMART-on-FHIR OAuth2 oauth2
· flows: authorizationCode
OpenID Connect openIdConnect

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-18'
method: searched
source: https://login.devoted.com/.well-known/openid-configuration
docs: https://www.devoted.com/developers/
summary:
  types: [oauth2, openIdConnect]
  authorization_framework: SMART-on-FHIR
  oauth2_flows: [authorizationCode]
  notes: >-
    Devoted Health's FHIR APIs use OAuth 2.0 / OpenID Connect with SMART-on-FHIR
    authorization, as declared in each server's CapabilityStatement
    (rest.security.service = SMART-on-FHIR) and the OpenID Connect discovery
    document. The Patient Access API requires member-authorized (patient-scoped)
    access tokens; third-party member-facing apps first register with Devoted's
    interoperability team to obtain a Client ID and Client Secret. The OpenAPI /
    Swagger definitions themselves do not declare securitySchemes, so this
    profile is sourced from the OIDC discovery document and CapabilityStatement.
schemes:
- name: SMART-on-FHIR OAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.devoted.com/authorize
    tokenUrl: https://login.devoted.com/oauth/token
  applies_to:
  - openapi/devoted-health-patient-access-openapi-original.json
  evidence:
  - conformance/devoted-health-patient-access-capabilitystatement.json (rest.security.service SMART-on-FHIR)
  - well-known/devoted-health-smart-configuration.json
- name: OpenID Connect
  type: openIdConnect
  openIdConnectUrl: https://login.devoted.com/.well-known/openid-configuration
  issuer: https://login.devoted.com/
  endpoints:
    authorization: https://login.devoted.com/authorize
    token: https://login.devoted.com/oauth/token
    userinfo: https://login.devoted.com/userinfo
    jwks_uri: https://login.devoted.com/.well-known/jwks.json
    registration: https://login.devoted.com/oidc/register
    revocation: https://login.devoted.com/oauth/revoke
    device_authorization: https://login.devoted.com/oauth/device/code
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post, private_key_jwt, none]
  code_challenge_methods: [S256, plain]
  evidence:
  - well-known/devoted-health-openid-configuration.json
app_registration:
  process: >-
    Third-party member-facing applications register their organization and app
    via Devoted's App Registration Form; Client ID and Client Secret are issued
    by the interoperability team after review, delivered by secure (Virtru) email.
  form: https://forms.gle/UFYvckiAeEjWP49K9
  contact: interop@devoted.com