Hi! We are building a health app using Medplum and would be initially self-hosting. I have a question about best practices when authenticating via native mobile apps. Our healthcare app doesn't allow self-registration. Flow: clinic admin creates Patient → assigns activation code → patient enters code in iOS app → verifies identity (DOB + phone last 4) → creates password → gets tokens. Current approach: - iOS app uses client_credentials grant (ClientApplication) to get bearer token - App calls bots for: code validation, identity verification, password setup, login - Passwords stored as PBKDF2 hash in Patient extensions (no Medplum User accounts) Concern: client_secret is embedded in iOS binary. Anyone extracting it can call bots directly - brute-force activation codes or probe for patient emails. Question: Better pattern for mobile apps calling bots before user identity exists? PKCE needs a user first, and our "user" doesn't exist until after activation completes. Alternatives considered: proxy API in front of Medplum, anonymous tokens for activation only. Thanks in advance! Mike

Hi Mike, Just to share our experience, we have kind of a similar flow where a prescriber invites a patient using his phone number, the patient receives an SMS, installs the app, and logs in using his phone number. We've had to implement a intermediate API that communicates between our mobile and Medplum in order to store our credentials in a secure manner. It actually helps us a lot to use the intermediate endpoint to handle strong or complex business logic. Tell me what you decide to do, but I would definetely not store credentials in the mobile app itslef.

Hey there! Thanks for your reply. Would you mind elaborating a bit more about your solution in terms of what the intermiate API does?

You've probably already seen this, but in case it is helpful: https://github.com/vintasoftware/medplum-chat-app

Hi, Yes sure, we basically use something like that : https://www.medplum.com/docs/auth/on-behalf-of Our front end makes a call to our server app which makes calls to our medplum server. This is required because we also do account creation from the frontend app. Maybe if you only do login, then it is not necessary.

Thanks! Yes, our app will not initially support account creation, but we will will still be following this pattern of using On-Behalf by exposing a seperate endpoint for mobile.