At some point almost every backend team working with an EHR runs into the same wall: you need to pull patient data on a schedule no clinician sitting at a browser, no login screen, just a job that wakes up, fetches records, and writes them somewhere useful. Standard SMART on FHIR, the flavor most people learn first, assumes a human is present to click “Allow.” That doesn’t work for a background job.
This is the exact problem SMART Backend Services was built to solve, and this post walks through how the authentication flow actually works, what the moving pieces are, and the specific things that tend to trip people up when they implement it for the first time.
The Problem We Needed to Solve
A background integration needs to talk to an EHR’s FHIR API on its own schedule nightly batch pulls, queue-driven jobs, whatever the trigger is. There’s no browser session, no user typing a password, and often no human anywhere near the request when it fires.
Regular SMART App Launch is built around a user: redirect them to the EHR’s login page, they authenticate, they approve a consent screen, and the app gets a token tied to that session. That flow simply has no place to plug in when the “user” is a cron job or a task queue consumer. You can’t redirect a server process to a login form and wait for someone to click through it.
What you actually want is closer to how two systems normally trust each other in the backend world: the app proves its own identity with something it holds privately, and the authorization server hands back a token scoped to what that app is allowed to do no session, no browser, no human step at all.
Understanding SMART Backend Services
SMART Backend Services is the part of the SMART on FHIR spec that covers exactly this case: system-to-system access, no user in the loop.
The core difference from user-facing SMART apps is what proves identity. In the interactive flow, identity is established through a login + consent screen and the token represents a user’s authorization. In Backend Services, the application itself is the trusted party. It proves who it is using a private key it holds, and the token represents the application’s own authorization to access data not any particular person’s.
Practically, that means:
- No redirect, no login page, no consent screen at request time.
- Trust is established once, out of band, when the app is registered with the EHR (its public key or JWKS URL is registered ahead of time).
- Every subsequent authentication is the app cryptographically proving “I am who I say I am” using a private key only it has.
- Tokens are short-lived and get refreshed automatically by the backend there’s no session to keep alive, just a token to renew before it expires.
This is what makes it fit background jobs and pipelines: the auth step is just another function call in the code path, not a UI interaction.
How the Architecture Works
At a high level, there are three players: our backend, the EHR’s authorization server, and the EHR’s FHIR server. The backend proves itself to the authorization server, gets a token, and uses that token against the FHIR server.
Nothing in this diagram involves a browser or a person. Steps 1 through 3 happen entirely inside the backend and the authorization server; step 4 is a normal authenticated HTTP call once the token is in hand.
Authentication Flow, Step by Step
1. The backend decides it needs to call the FHIR API. This could be the start of a batch job, or a cache miss on an existing token.
2. It builds a JWT assertion a small signed document that says “this is me, and this request is fresh.”
3. The JWT carries a specific set of claims (iss, sub, aud, jti, iat, exp) that identify the client, target the right audience, and prevent replay. More on each of these below.
4. The JWT is signed with the app’s private key, using an asymmetric algorithm like RS384. The EHR only ever sees the corresponding public key (registered ahead of time), never the private key itself.
5. The backend POSTs the signed assertion to the authorization server’s token endpoint, along with the client_credentials grant type and the requested scopes.
6. The authorization server validates the JWT checks the signature against the registered public key, confirms the claims (audience, expiry, issuer) line up, and confirms the app is allowed the scopes it’s asking for.
7. If everything checks out, it returns a short-lived access token (typically valid for under an hour).
8. The backend attaches that token as a Bearer credential on every subsequent FHIR API call, until it expires and step 1 repeats.
Each step exists for a reason: the JWT proves identity without ever transmitting a shared secret over the wire, the short expiry (exp) limits how long a stolen assertion would be usable even if intercepted, and the unique jti stops a captured assertion from being replayed a second time.
Sequence Diagram
Key Components
| Component | What it does | Simple explanation |
|---|---|---|
| Client ID | Identifies the backend application to the EHR | Like a username for the app, registered ahead of time |
| Private Key | Signs the JWT assertion | Proves the request really came from us, without sending a password |
| Public Key / JWKS | Lets the EHR verify our signature | The EHR’s copy of our “signature sample,” registered during onboarding |
| JWT Client Assertion | The signed proof-of-identity document | A short-lived, tamper-evident note saying “this is us, right now” |
| iss / sub claims | Identify the client in the JWT | Both set to the client ID, the app is both the issuer and the subject of the claim |
| aud claim | States who the JWT is meant for | The token endpoint URL, stops the assertion being replayed against a different server |
| jti claim | Unique ID per JWT | Prevents the same signed assertion from being reused (replay protection) |
| exp claim | Expiry timestamp on the JWT itself | Keeps the assertion valid only for a few minutes, not the token’s own lifetime |
| Access Token | The credential used for actual API calls | A short-lived pass, earned by presenting the signed JWT |
| Scopes | What the token is allowed to access | Boundaries on which FHIR resources/operations the token can touch |
It’s worth being precise about something that confuses people early on: the JWT assertion and the access token are two different, short-lived things. The JWT proves identity to get a token; the access token is what you actually attach to FHIR calls. Mixing these up e.g., trying to use the client assertion itself as a Bearer token is a common early mistake.
PakarPBN
A Private Blog Network (PBN) is a collection of websites that are controlled by a single individual or organization and used primarily to build backlinks to a “money site” in order to influence its ranking in search engines such as Google. The core idea behind a PBN is based on the importance of backlinks in Google’s ranking algorithm. Since Google views backlinks as signals of authority and trust, some website owners attempt to artificially create these signals through a controlled network of sites.
In a typical PBN setup, the owner acquires expired or aged domains that already have existing authority, backlinks, and history. These domains are rebuilt with new content and hosted separately, often using different IP addresses, hosting providers, themes, and ownership details to make them appear unrelated. Within the content published on these sites, links are strategically placed that point to the main website the owner wants to rank higher. By doing this, the owner attempts to pass link equity (also known as “link juice”) from the PBN sites to the target website.
The purpose of a PBN is to give the impression that the target website is naturally earning links from multiple independent sources. If done effectively, this can temporarily improve keyword rankings, increase organic visibility, and drive more traffic from search results.
