Lifen · Authentication Profile

Lifen Authentication

Authentication

Lifen secures its APIs with oauth2, openIdConnect, and apiKey across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials and authorizationCode flow(s).

CompanyHealthcareFHIRInteroperabilityHealth DataElectronic Health RecordsMedical DocumentsSecure MessagingFranceHL7
Methods: oauth2, openIdConnect, apiKey Schemes: 3 OAuth flows: clientCredentials, authorizationCode API key in: header

Security Schemes

client_credentials oauth2
sso_oidc openIdConnect
sec0 apiKey
· in: header (Authorization)

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-19'
method: searched
source: https://developer.lifen.fr/docs/machine-to-machine-communications
docs: https://developer.lifen.fr/docs/machine-to-machine-communications
summary:
  types:
  - oauth2
  - openIdConnect
  - apiKey
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
  - authorizationCode
schemes:
- name: client_credentials
  type: oauth2
  flow: clientCredentials
  token_endpoint: https://authentication.lifen.fr/v1/token
  token_endpoint_test: https://authentication.post-prod.lifen.fr/v1/token
  request_parameters:
  - client_id
  - client_secret
  - audience
  - database_reference
  - grant_type
  token_type: Bearer
  token_lifetime_seconds: 172800
  applied_as: Authorization header, "Bearer {access_token}"
  notes: >-
    Machine-to-machine access to the FHIR API. `audience` selects the environment
    (https://production.platform-apis/ or https://post-prod.platform-apis/) and `database_reference`
    binds the token to one healthcare organisation. Credentials are issued by a Lifen account
    manager, not self-service.
  sources:
  - openapi/lifen-authentication-api-openapi.json
  - https://developer.lifen.fr/docs/machine-to-machine-communications
- name: sso_oidc
  type: openIdConnect
  flow: authorizationCode
  issuer: https://login.lifen.fr/
  authorization_endpoint: https://authentication.lifen.fr/authorize
  token_endpoint: https://authentication.lifen.fr/v1/authorization_code/token
  jwks_uri: https://authentication.lifen.fr/.well-known/jwks.json
  pkce: true
  code_challenge_methods:
  - S256
  token_endpoint_auth_methods:
  - none
  logout_endpoint: https://api.lifen.fr/sso/v1/session/logout
  notes: >-
    User-facing SSO for embedding Lifen in a partner application; PKCE-only public client.
  sources:
  - well-known/lifen-oauth-authorization-server.json
  - https://developer.lifen.fr/docs/sso-api
- name: sec0
  type: apiKey
  in: header
  parameter: Authorization
  notes: >-
    How the published OpenAPI models the bearer token (x-bearer-format bearer). Functionally this is
    the OAuth 2.0 access token from the client_credentials scheme above, not a static API key.
  sources:
  - openapi/lifen-fhir-api-openapi.json
webhook_authentication:
  mechanism: HMAC-SHA256 signature
  header: x-lifen-platform-signature
  secret: generated per application in the developer portal
  ip_allowlist:
    test:
    - 15.236.169.32
    production:
    - 15.236.169.164
    - 35.180.249.12
  docs: https://developer.lifen.fr/docs/secure-your-webhooks
scopes: scopes/lifen-scopes.yml

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/lifen-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.