Medplum is the fasted way to build high quality, scalable and compliant healthcare applications

medplum

image

Yes, that's right.  You would set your jwks.json URL in the ClientApplication details page:

<@286995898364592128> <@963922231224844359> just to confirm that I correctly understand the private_jwt_key flow:
Step 1. Setup jwks.json endpoint like https://codexhealth.com/.well-known/jwks.json - or something like this.
Step 2. Codex -> Send the signed jwt request to get patient by id
Step 3. MedPlum -> Get jwks.json endpoint to get key information and validate the request was signed properly
Step 4. We are good and returns the patient information, right?

and jwks_uri field says that it should not private_key_jwt but client_secret_jwt right?

Correct.  You can look at this unit test for a summary: https://github.com/medplum/medplum/blob/main/packages/server/src/oauth/token.test.ts#L964-L992

Client/secret will still work.  In order to use the private_key_jwt, you must also send `client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',`

https://build.fhir.org/ig/HL7/smart-app-launch/app-launch.html#request-4 based on this documentation `aud` should be required parameter 
are you planning to add it here: https://www.medplum.com/docs/api/oauth/authorize#request-parameters ?