FHIR RESTful API: 5 Design Patterns for Production Endpoints

Exposing a FHIR RESTful API to external consumers isn't just "turn on endpoints." Five design patterns cover most production challenges around auth, rate limits, versioning, and versioning strategy. Pattern 1: Auth server separated from resource server. SMART on FHIR mandates OAuth 2.0 with a distinct authorization server. Keycloak, Auth0, or purpose-built work. The resource server […]

FHIR Server Authentication: SMART Backend Services in Practice

Server-to-server FHIR authentication uses SMART Backend Services — the machine-to-machine cousin of SMART's patient launch. The spec is well-defined; production implementation has a few edge cases worth understanding. Client credentials + JWT assertion. The client generates a JWT signed with its private key. The auth server verifies signature against the registered public key and issues […]