Identity & access

Developer onboarding without exposing PHI

Workspace identities can help approve partner developers, but production API access remains OAuth-scoped, tenant-bound, audit-logged, and separated from patient data until contractual and compliance gates are complete.

1. Authenticate (OAuth 2.0 client_credentials)Request developer access

Compliance guardrail:

No external workspace identity bypasses BAAs, consent, tenant isolation, role review, scoped API credentials, encryption, or immutable audit logging.

Enterprise SSO

Provider, admin, and approved developer workspaces for covered entities, business associates, and enterprise partners.

GitHub

Developer docs, sandbox apps, SDK review, issue triage, and non-PHI technical collaboration.

Slack

Partner launch rooms, support escalation, implementation coordination, and non-PHI operational updates.

Production API

Server-to-server integrations, embedded widgets, webhooks, and approved partner automation.

Enterprise SSO

OIDC or SAML for approved organizations, with tenant policy, MFA expectations, and immutable access review evidence.

Request developer access

GitHub developer access

Useful for technical partners and API reviewers. GitHub identity can gate docs and sandbox workspaces, not PHI workflows.

Request developer access

Slack partner access

Useful for partner channels, support escalation, and launch rooms. Access stays least-privilege and auditable.

Request developer access

OAuth 2.0 client credentials

1. Authenticate (OAuth 2.0 client_credentials)

OAuth client_credentials, tenant scopes, webhook signing, rate limits, key rotation, and least privilege.

No human social login can mint production API authority without SuperAdmin approval and scoped credentials.

Client registration, scope approval, token events, webhook delivery logs, and access-review attestations.