Identity & SSO
Integrate secure authentication, single sign-on and healthcare professional identity with Mediloop.
Available in sandboxProduction approval required
Standards
OAuth 2.0 + OpenID Connect
Security
Authorization Code + PKCE
Healthcare identity
France + Luxembourg
Access
Sandbox public · production approved
Overview
Mediloop Identity provides a standards-based boundary for authentication and authorization. Public developers can build and test in sandbox; production access is controlled.
Architecture
France
Pro Santé Connect → CPS/e-CPS → RPPS
Luxembourg
LuxTrust → approved registry verification
Standard
Mediloop OIDC / OAuth 2.0
Identity surfaces
| Surface | Purpose | Audience |
|---|---|---|
| OIDC | Sign-in and identity claims | Applications |
| OAuth 2.0 | Delegated API access | Applications |
| Professional identity | Verified healthcare identity | Healthcare professionals |
| Citizen identity | Patient/citizen sign-in | Patient-facing apps |
Environment access
| Environment | Access | Notes |
|---|---|---|
| Sandbox | Public developer access | Test identities and non-production data |
| Production | Approved partners only | Onboarding, review and explicit enablement |
Regional identity
Professional verification and organization/tenant membership are separate concerns. A verified practitioner identity does not itself grant access to an organization.
Security notes
Use least-privilege scopes, exact redirect URI matching, PKCE for public clients, short-lived access tokens and secure server-side storage for confidential credentials. Do not infer authorization from identity claims alone.
Errors
| Error | Meaning |
|---|---|
| invalid_request | Malformed or incomplete protocol request |
| invalid_client | Client authentication or registration failed |
| invalid_grant | Authorization grant is invalid or expired |
| access_denied | User, policy or approval denied access |