Public Signing-Key Publishing (JWKS)

Every hospital connected to the app has its own signing key pair. This page covers where your EHR team points at the public half of that key to verify that authentication requests really came from us.

Where your EHR fetches the key

The app publishes signing keys at a single, standard, publicly reachable address: /.well-known/jwks.json — the address includes your hospital’s current key, plus, briefly, its previous key during a rotation window. Your EHR fetches this address automatically to verify requests, the same mechanism used industry-wide for SMART Backend Services and single sign-on. Your technical team points your EHR at this address once during setup; no shared password or secret ever needs to be exchanged out of band.

Key rotation

Signing keys rotate on a defined rotation schedule. When a key rotates, the previous key stays valid at the same address for a short overlap window, so any verification already in flight does not break during the rotation.