Hi there, I'm attempting to stand up the example ( https://github.com/medplum/medplum-client-external-idp-demo/tree/main ) external IdP flow with my hosted medplum project but I'm getting the following back from https://api.medplum.com/auth/external

{
  "resourceType": "OperationOutcome",
  "issue": [
    {
      "severity": "error",
      "code": "invalid",
      "details": {
        "text": "Failed to verify code - check your identity provider configuration"
      }
    }
  ],
  "extension": [
    {
      "url": "https://medplum.com/fhir/StructureDefinition/tracing",
      "extension": [
        {
          "url": "requestId",
          "valueId": "06149170-c63e-414c-81ac-3aba919be269"
        },
        {
          "url": "traceId",
          "valueId": "1-6924bbdb-54b107a33232693458766d13"
        }
      ]
    }
  ]
}

any ideas? I've configured everything as per the documentation but it seems like the medplum auth/external endpoint doesn't like the config somewhere. The url that my IdP sends to has a

code

and a

state

parameter on it and the state has URL encoded JSON with the

projectId

,

clientId

and

redirectUri

inside.

Hi @lazybaer , I am happy to help! Can you confirm that your IDP is configured with your self hosted API's version of this redirect URI:

https://api.medplum.com/auth/external

so I'm running the example application on my

localhost

and it's configured with

const MEDPLUM_BASE_URL = 'https://api.medplum.com/';
const EXTERNAL_REDIRECT_URI = MEDPLUM_BASE_URL + 'auth/external';

so yes it should be hitting that URL

Ok, gotcha. If you are self hosting, that

MEDPLUM_BASE_URL

will need to be your hosted API URL

I am not self hosting. I'm using the medplum hosted version

Ahh, ok I misunderstood from your initial question. Do you have the web app

redirectUri

set on the

ClientApplication

?

on the medplum side? yes I do

Ok, by default I believe that example app runs at

http://localhost:8000/

yup. I updated to port 3000

can you try without the

/signin

?

the app runs, displays the sign in button, pushes me to clerk, I auth and approve the Oauth application

No, actually that should be fine

Can you confirm that the

MEDPLUM_CLIENT_ID

you set in the example app is the ClientApplication that you sent screenshot of from above?

this on the medplum side https://cdn.discordapp.com/attachments/1442610329690575049/1442620865954058252/image.png?ex=69411fa1&is=693fce21&hm=d97177457b300b61c2cea4a15ddb86db40ab4fdebb2c4d741f459c818377cd5c&

Ok nice! Now can you confirm that these are consistent with your Clerk setup?

/**
 * External OAuth2 "authorize" endpoint URL.
 * For example, this would be an Auth0, AWS Cognito, or Okta URL.
 * This value is specific to your external auth provider.
 */
const EXTERNAL_AUTHORIZE_URL = '';

/**
 * External OAuth2 client ID.
 * This value is specific to your external auth provider.
 */
const EXTERNAL_CLIENT_ID = '';

Ok, gotcha. And did you set

ClientApplication.identityProvider

?

in the code like so?

const handleClick = useCallback(() => {
    medplum
      .signInWithExternalAuth(
        EXTERNAL_AUTHORIZE_URL,
        EXTERNAL_CLIENT_ID,
        EXTERNAL_REDIRECT_URI,
        {
          projectId: MEDPLUM_PROJECT_ID,
          clientId: MEDPLUM_CLIENT_ID,
          redirectUri: WEB_APP_REDIRECT_URI,
        },
        false,
      )
      .catch(console.error);
  }, [medplum]);

Yes, but also on the ClientApplication:

{
  "resourceType": "ClientApplication",
  "redirectUri": "http://localhost:3000/signin",
  "identityProvider": {
    "authorizeUrl": "https://YOUR_CLERK_DOMAIN/oauth/authorize",
    "tokenUrl": "https://YOUR_CLERK_DOMAIN/oauth/token",
    "clientId": "YOUR_CLERK_CLIENT_ID",
    "clientSecret": "YOUR_CLERK_CLIENT_SECRET"
  }
}

in the medplum

ClientApplication

record those are all set, yes

Ok, [here](https://github.com/medplum/medplum/blob/ec580462ffb705f4de5e6dc6d8748c181e56503e/packages/server/src/auth/external.ts#L216-L229) is where the token request to clerk is failing

oh no. So it's on the medplum service side?

Does the Clerk dashboard give you any logs for error messages? We don't store store that info in our logs unfortunately

Clerk doesn't see to have anything unfortunately

Maybe try to hit your Clerk token url directly with postman or curl?

so got through the flow, hit the error, and then take the

code

from the URL and try and make this call? https://github.com/medplum/medplum/blob/ec580462ffb705f4de5e6dc6d8748c181e56503e/packages/server/src/auth/external.ts#L189

Yea, exactly

gotcha. ok. I can give that a try. thanks @finnbergquist

Glad you got it working!

@finnbergquist one more quick question for you. Can the Medplum client config have more than one redirect URI ?

@lazybaer , picking this back up - within ClientApplication you can set an array of

redirectUris

- https://www.medplum.com/docs/api/fhir/medplum/clientapplication

Thank you!

@lazybaer can you look again?

@lazybaer it should be just below

Redirect URI

https://cdn.discordapp.com/attachments/1442610329690575049/1448390816551665834/Screenshot_2025-12-10_at_11.07.38.png?ex=693b1690&is=6939c510&hm=4425abca3158e6337bcaf1d0a25df321c8098d09e16ee4d4fba63e997621b25d&

🤦🏼‍♂️ I see it now. I'm not sure how I could have possibly missed that. thanks a ton