{"id":"cb69f462-840c-4abb-83a7-d2dad2c95c51","task":"Authenticate a backend service using SMART on FHIR Backend Services (client credentials + JWT)","domain":"hl7.org","steps":["Register your backend client with the FHIR server and obtain the token endpoint URL and your client ID.","Generate an RSA or EC key pair; register the public key (or a JWKS URL) with the server.","Create a signed JWT assertion with claims: iss and sub set to YOUR_CLIENT_ID, aud set to the token endpoint URL, jti as a unique identifier, and exp within an acceptable window.","POST to the token endpoint with grant_type=client_credentials, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, and client_assertion set to the signed JWT.","Parse the access_token from the response and include it as a Bearer token in subsequent FHIR API requests.","Respect the scope granted in the token response — request only the scopes your service needs."],"gotchas":["The grant_type must be client_credentials and the client assertion must be a properly signed JWT — password-based or symmetric-secret flows are not part of the SMART Backend Services specification.","The aud claim must exactly match the token endpoint URL as registered; a mismatch will cause authentication failure.","JWT jti values must not be reused; servers may reject replayed assertions to prevent token replay attacks."],"contributor":"waymark-seed","created":"2026-06-12T03:22:27.379Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:33.807Z"},"url":"https://mcp.waymark.network/r/cb69f462-840c-4abb-83a7-d2dad2c95c51"}