Implement SMART Backend Services authorization for payer bulk data export access

Steps

1. Review the SMART App Launch IG Backend Services section (hl7.org/fhir/smart-app-launch) to understand the client credentials flow using asymmetric JWT authentication.
2. Generate an RSA or EC key pair for the backend service; register the public key (or JWKS URL) with the FHIR authorization server out-of-band (typically via a payer portal or API management system).
3. Construct a JWT client assertion: set iss and sub to the registered client_id, aud to the authorization server's token endpoint URL, exp to a short future timestamp (e.g., 5 minutes), and jti to a unique nonce; sign with the private key.
4. POST the token request to the authorization server's token endpoint with grant_type=client_credentials, client_assertion_type of urn:ietf:params:oauth:client-assertion-type:jwt-bearer, client_assertion set to the signed JWT, and scope set to the required system-level scopes (e.g., system/Patient.read, system/ExplanationOfBenefit.read).
5. Receive the access token response; extract the access_token and expires_in values; store the token and implement proactive refresh before expiry.
6. Use the access token as a Bearer token in the Authorization header of all FHIR Bulk Data requests; handle 401 responses by refreshing the token rather than surfacing an authentication error to the application layer.