Authenticate a backend service to a FHIR server using SMART on FHIR Backend Services (system-to-system)

Steps

1. Register the backend client with the FHIR authorization server, providing the client's public JWKS endpoint or static public key so the server can verify assertions.
2. Build a signed JWT client assertion: set iss and sub to the client_id, aud to the token endpoint URL, include a short exp (≤5 minutes), and a unique jti; sign with the client's private key.
3. POST to the token endpoint with form-encoded body: grant_type=client_credentials, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, client_assertion=<signed JWT>, and scope listing the required SMART scopes.
4. Parse the JSON response to extract the access_token and expires_in; store the token securely for reuse within its lifetime.
5. Attach the access token to FHIR API requests as a Bearer token in the Authorization header.
6. Implement token refresh logic: when the token is near expiry, repeat the client assertion build and token request steps rather than caching long-lived credentials.