Complete 8-step OAuth 2.0 authorization code flow with PKCE for apps launched outside the EHR.
SMART App Launch
The standalone launch flow follows the SMART App Launch Framework with PKCE (S256). The app initiates the OAuth 2.0 authorization code flow without an EHR context.
App constructs an authorization URL and redirects the user's browser to the eCW authorization server.
User authenticates and authorizes the requested scopes.
Provider Apps
eCW EHR login page
Patient Apps
healow login page
eCW redirects back to your app's redirect_uri with a short-lived authorization code and the state parameter for CSRF verification.
App POSTs to the token endpoint with the authorization code, a signed JWT client assertion (RS384), and the PKCE code verifier.
eCW returns the access token, refresh token, ID token, and metadata about the session.
Use the access token as a Bearer token in the Authorization header to make FHIR R4 API requests.
GET /fhir/r4/Patient/{id} — Authorization: Bearer {access_token}When the access token expires (after 1 hour), exchange the refresh token for a new token pair. A new client_assertion JWT is required.
eCW returns a new access token and a new refresh token. The old refresh token is invalidated and cannot be reused.
Refresh tokens are single-use. The old token is invalidated when a new one is issued. Store the new refresh token immediately.
Flow Legend