Hi! I'm trying to authenticate a backend using OAuth2 Client Credentials on Medplum 5.1.21 (official Docker Compose setup), but every request authenticated with the ClientApplication token returns 401 Unauthorized. Steps: 1. Fresh Medplum install. 2. Logged in as super admin. 3. Created a new Project. 4. Created an AccessPolicy in that project. 5. Created a ClientApplication via:

POST /admin/projects/{projectId}/client

6. Requested a token via:

POST /oauth2/token

grant_type=client_credentials

7. Received a valid JWT. The decoded JWT contains

client_id

,

profile

,

login_id

, correct `iss`/`aud`, etc. However, every request returns 401, including: *

GET /auth/me

*

GET /fhir/R4/Patient

*

POST /fhir/R4/Organization

The response is always:

json
{
  "resourceType": "OperationOutcome",
  "issue": [
    {
      "code": "login",
      "details": {
        "text": "Unauthorized"
      }
    }
  ]
}

Things I've verified: * Official Docker Compose deployment (

medplum/medplum-server:5.1.21

) * Authorization header is

Bearer <token>

* Token is issued successfully by the same server (

http://localhost:8103

) * Same behavior whether using the bootstrap project or a newly created project * Super admin JWT works for FHIR requests Is a

ClientApplication

obtained via the client_credentials flow supposed to authenticate directly against the FHIR API? Is there an additional bootstrap/configuration step I'm missing, or could this be a known issue in 5.1.21? Any guidance would be appreciated.

Can you create a ClientApplication not as super admin?