Devoted Health · Authentication Profile

Devoted Authentication

Authentication

Devoted Health secures its APIs with oauth2 and openIdConnect across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode and clientCredentials flow(s).

CompanyHealthcareMedicare AdvantageHealth InsuranceFHIRInteroperabilityCMS Patient AccessPayer
Methods: oauth2, openIdConnect Schemes: 2 OAuth flows: authorizationCode, clientCredentials API key in:

Security Schemes

OpenIDConnect openIdConnect
OAuth2 oauth2
· flows: authorizationCode, clientCredentials

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-18'
method: searched
source: https://www.devoted.com/developers/
docs: https://www.devoted.com/developers/
notes: >-
  Devoted Health's member-facing FHIR APIs (Patient Access) require member
  authorization via OAuth 2.0 / OpenID Connect, per the CMS Interoperability and
  Patient Access rule (21st Century Cures Act). The authorization server is an
  Auth0 tenant published at https://login.devoted.com/.well-known/openid-configuration.
  Third-party applications register with Devoted's interoperability team
  (interop@devoted.com) and receive a client_id/client_secret via Virtru-encrypted
  email. The non-member Provider & Pharmacy Directory and Plan Coverage & Formularies
  FHIR APIs are public and do not require member authorization.
summary:
  types:
  - oauth2
  - openIdConnect
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  registration: manual (app registration form + interop team review)
schemes:
- name: OpenIDConnect
  type: openIdConnect
  openIdConnectUrl: https://login.devoted.com/.well-known/openid-configuration
  issuer: https://login.devoted.com/
  authorization_endpoint: https://login.devoted.com/authorize
  token_endpoint: https://login.devoted.com/oauth/token
  userinfo_endpoint: https://login.devoted.com/userinfo
  jwks_uri: https://login.devoted.com/.well-known/jwks.json
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  - private_key_jwt
  - none
  sources:
  - well-known/devoted-openid-configuration.json
- name: OAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.devoted.com/authorize
    tokenUrl: https://login.devoted.com/oauth/token
    scope_ref: scopes/devoted-scopes.yml
  - flow: clientCredentials
    tokenUrl: https://login.devoted.com/oauth/token
  sources:
  - well-known/devoted-openid-configuration.json
apis:
- name: Patient Access API
  requires_member_authorization: true
  base_url: https://api.prod.devoted.com/fhir
- name: Provider & Pharmacy Directory API
  requires_member_authorization: false
  base_url: https://fhir.devoted.com/fhir
- name: Plan Coverage & Formularies API
  requires_member_authorization: false
  base_url: https://fhir.devoted.com/fhir