SMART-on-FHIR OAuth Integration Specialist — Healthcare API Connectors

GenEnterprises is a healthcare technology company seeking a specialist to validate patient-access APIs. The role involves ensuring seamless integration with healthcare systems and verifying API functionality. The ideal candidate will have experience in healthcare technology and API validation, with a strong understanding of data security and compliance. What you'll do (per vendor) -Discover the vendor's SMART-on-FHIR endpoints from their conformance statement (/metadata) or .well-known/smart-configuration. -Complete a provided configuration file with the correct authorize/token/FHIR endpoints and patient-access scopes. -Run our provided validation harness against the vendor's sandbox and prove the full authorization flow completes end-to-end — either public-client (PKCE) or confidential-client (client secret) depending on the vendor: authorize → code → token exchange → patient context. -Document any vendor quirks (audience value, extra scopes, non-standard discovery, sandbox limits). What we provide -The validation kit (a small Node harness + config template + rules — runs locally). -The sandbox credentials for the vendor: a client_id, plus a client_secret for confidential vendors, and the registered redirect URIs. -Sandbox access details and the specific vendor to start with. Deliverables -A completed connector configuration — patient-scoped only. Public vendors carry no secret; confidential vendors carry only the sandbox secret we provide (never a production secret). -The endpoint-discovery source you used (the /metadata or .well-known URL). -Evidence of a successful sandbox run: the harness "PASS" page/screenshot and console output showing an access token and a resolved patient ID. -Confirmation the registered redirect URI matches the config exactly. -Notes on any vendor-specific quirks. Requirements -Hands-on experience with SMART-on-FHIR patient-access authorization. -Solid understanding of OAuth 2.0 Authorization Code, both PKCE (public client) and client-secret (confidential client) flows, and when each applies. -Comfortable reading FHIR R4 conformance statements to locate endpoints and scopes. -Enough Node.js to run a provided harness (npm install, edit a JSON config, npm start). -Precise and evidence-driven — you prove things work rather than assuming. Nice to have -Prior integration with EHR/health-data vendors (Veradigm/FollowMyHealth, athenahealth, Epic, Cerner/Oracle Health, Aetna, or similar). -Familiarity with patient access APIs and healthcare interoperability standards. What you will NOT have access to (and won't need) -No production systems, no real patient data — everything is sandbox/synthetic. -No access to our codebase or database — the kit is fully standalone. -No vendor account administration — we own the developer registration; you receive the sandbox credentials only. This keeps the engagement clean and low-risk for both sides. An NDA is required before we share the kit. Engagement -Fixed price per vendor. First vendor is a paid pilot (budget: $[SET BUDGET]); strong work leads to ongoing per-vendor engagements. -Remote, flexible hours. Turnaround for the pilot is typically a few days once you have the sandbox credentials. To apply — please answer these (applications without answers will be skipped) -Which EHR vendor sandboxes have you completed a SMART-on-FHIR patient-access OAuth flow against (PKCE or client-secret)? Name them. -Given only a FHIR base URL, how do you find the authorize and token endpoints? -In one or two sentences: what is the difference between a public and a confidential OAuth client, and when would you use PKCE?