Production access
Prepare an Identity & SSO integration for partner review and controlled production enablement.
Available in sandboxProduction approval required
Standards
OAuth 2.0 + OpenID Connect
Security
Authorization Code + PKCE
Healthcare identity
France + Luxembourg
Access
Sandbox public · production approved
Overview
Production Identity & SSO is partner-only. Approval, onboarding and application review are required before production credentials are enabled.
Partner approval
| Capability | Use | Status |
|---|---|---|
| Authorization Code + PKCE | Browser, mobile and native apps | Recommended |
| OIDC | Authentication and identity claims | Supported |
| OAuth 2.0 | Delegated API authorization | Supported |
| Client credentials | Approved server-to-server integrations | Partner access |
Application review
OIDC scopes
openid profile email
# Additional healthcare or organization claims require explicit approval.Security notes
Use least-privilege scopes, exact redirect URI matching, PKCE for public clients, short-lived access tokens and secure server-side storage for confidential credentials. Do not infer authorization from identity claims alone.
Errors
| Error | Meaning |
|---|---|
| invalid_request | Malformed or incomplete protocol request |
| invalid_client | Client authentication or registration failed |
| invalid_grant | Authorization grant is invalid or expired |
| access_denied | User, policy or approval denied access |