Fast Healthcare Interoperability Resources · Authentication Profile

Fhir Authentication

Authentication

Fast Healthcare Interoperability Resources secures its APIs with oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions.

HealthcareStandardsInteroperabilityFHIRHL7Clinical DataHealth ITOpen StandardSMART on FHIRClinicalCDADICOMICDLOINCSNOMED CTUS Core
Methods: oauth2 Schemes: 3 OAuth flows: API key in:

Security Schemes

SMART App Launch (user-facing apps) oauth2
SMART Backend Services (system-to-system) oauth2
Transport security tls

Source

Authentication Profile

Raw ↑ 
generated: '2026-11-05'
method: searched
source: https://hl7.org/fhir/security.html; https://hl7.org/fhir/smart-app-launch/; https://hl7.org/fhir/smart-app-launch/app-launch.html;
  https://hl7.org/fhir/smart-app-launch/backend-services.html; https://hl7.org/fhir/smart-app-launch/conformance.html
docs: https://hl7.org/fhir/security.html
summary:
  types:
  - oauth2
  note: The FHIR core specification does not mandate an authentication scheme and the saved OpenAPI contracts declare
    no securitySchemes; security.html says "Users/Clients must be authenticated. For web-centric, OAuth is recommended,
    consider use of HL7 SMART App Launch Implementation Guide where appropriate." The schemes below are the HL7
    SMART App Launch profiles of OAuth 2.0 that FHIR servers advertise through .well-known/smart-configuration.
schemes:
- name: SMART App Launch (user-facing apps)
  type: oauth2
  flow: authorizationCode
  description: 'OAuth 2.0 authorization code grant with PKCE: "SMART servers SHALL support the S256 code_challenge_method
    and SHALL NOT support the plain method." Token response carries access_token, scope, optional id_token (openid
    fhirUser) and optional refresh_token (offline_access / online_access). Endpoints are discovered from the server''s
    .well-known/smart-configuration document, "available at .well-known/smart-configuration relative to a FHIR Server
    Base URL".'
  discovery: '{base}/.well-known/smart-configuration'
  scopes_docs: https://hl7.org/fhir/smart-app-launch/scopes-and-launch-context.html
  sources:
  - https://hl7.org/fhir/smart-app-launch/app-launch.html
  - https://hl7.org/fhir/smart-app-launch/
- name: SMART Backend Services (system-to-system)
  type: oauth2
  flow: clientCredentials
  description: 'Token request to the server token endpoint "using content-type application/x-www-form-urlencoded
    with the following parameters: scope required; grant_type required Fixed value: client_credentials; client_assertion_type
    required Fixed value: urn:ietf:params:oauth:client-assertion-type:jwt-bearer; client_assertion required Signed
    authentication JWT value". Clients are pre-registered with the server and request system/ scopes.'
  sources:
  - https://hl7.org/fhir/smart-app-launch/backend-services.html
- name: Transport security
  type: tls
  description: '"Communications Security - all exchange of production data should be secured using TLS (e.g., https)."'
  sources:
  - https://hl7.org/fhir/security.html

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/fhir-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.