Retrieve Medicare claims data via CMS Blue Button 2.0 using authorization code OAuth flow

Verified steps

1. Register your application at the CMS Blue Button 2.0 developer portal to obtain a client_id and client_secret (YOUR_KEY); specify your redirect URI and select the required scopes (patient/Patient.read, patient/Coverage.read, patient/ExplanationOfBenefit.read, profile, offline_access)
2. Redirect the beneficiary to the CMS Blue Button authorization URL with response_type=code, client_id, redirect_uri, scope, and a unique state parameter; the beneficiary authenticates with their Medicare.gov credentials and grants consent
3. Exchange the returned authorization code for access and refresh tokens by POSTing to the CMS token endpoint with grant_type=authorization_code, code, redirect_uri, and your client credentials; store the refresh token securely for long-term access
4. Call the ExplanationOfBenefit endpoint with the bearer access token (YOUR_TOKEN) to retrieve the beneficiary's Medicare Part A, B, and D claims as FHIR R4 ExplanationOfBenefit resources returned in a paginated Bundle
5. Follow next-page links in the Bundle to retrieve all claims pages; each ExplanationOfBenefit resource contains claim dates, provider information, service codes (HCPCS, ICD-10), and payment amounts
6. Use the refresh token to obtain new access tokens before they expire; Blue Button 2.0 access tokens are short-lived and the refresh token must be used to maintain access without requiring the beneficiary to re-authenticate