Cerner

Create a Developer Account

1. Go to Cerner Care and create a developer account.

2. Fill in your email and complete the secret questions, then submit the registration form.

3. Once approved, sign in and navigate to the Cerner Code Console.

Create your Application

1. From the top navigation ribbon, click “My Applications”.

2. Click ”+ New Application”.

3. Fill in the application details:

Public vs Confidential

Select Confidential for Medblocks Platform. The platform has a backend that can hold the signing key safely, preserve the PKCE code_verifier, and send a signed client_assertion JWT during token exchange.

Public apps are only appropriate for browser-only or native clients that cannot hold a credential. That is not the Medblocks Platform flow.

Configure Endpoint URIs

Add a redirect URI for each environment you need:

http://localhost:3000/api/auth/smart/callback             # local development
https://app.medblocks.com/api/auth/smart/callback         # Medblocks Platform

Using the Medblocks Platform? Your callback URL is already handled. Use https://app.medblocks.com/api/auth/smart/callback as your production redirect URI - no custom domain or backend setup needed.

Click Add Another URI if you need more environments (e.g. staging).

⚠️ Critical: The URI must match exactly - including protocol, domain, port, and path. Any mismatch causes an immediate redirect_uri_mismatch error before the patient sees the login screen.

Configure Product Type

Set the following:

• Product Family: Millennium
• Products: Cerner FHIR APIs for Millennium: FHIR R4, All

Select Scopes

Select the API resources relevant to your use case. At minimum:

• Patients
• Observations

For full USCDI v1 coverage, also select:

• AllergyIntolerance, CarePlan, CareTeam, Condition, Device, DiagnosticReport, DocumentReference, Encounter, Goal, Immunization, MedicationRequest, Procedure, ServiceRequest, Coverage, RelatedPerson

Important Notes on Scopes

Set up Authentication

Cerner’s patient-facing flow has two pieces:

• PKCE binds the authorization request to the token exchange. The backend creates a code_verifier, sends the derived code_challenge to Cerner, then sends the original code_verifier when exchanging the code.
• JWT client authentication proves the confidential app’s identity. The backend signs a client_assertion JWT with its private key, and Cerner verifies it using the public key from the JWKS URI you register in the system account.

The token exchange should include:

• client_id
• code
• redirect_uri
• grant_type=authorization_code
• code_verifier
• client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
• client_assertion

Here is a minimal example of generating the PKCE pair server-side:

import { randomBytes, createHash } from "crypto";

const codeVerifier = randomBytes(96).toString("base64url"); // 128-char URL-safe string
const codeChallenge = createHash("sha256")
  .update(codeVerifier)
  .digest("base64url");

// Store codeVerifier server-side (e.g. encrypted session cookie)
// Send codeChallenge + code_challenge_method=S256 in the authorization request
// Send codeVerifier in the token exchange request

If you are integrating through Medblocks Platform, the platform handles the private key, JWT signing, JWKS endpoint, PKCE verifier storage, and token exchange. You only need to register the app as confidential and add the Medblocks JWKS URI in Cerner.

Save your Client ID

After saving the application, Cerner assigns a Client ID in UUID format:

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Copy this value. You will pass it as client_id in all authorization and token requests. If you are using the Medblocks Platform, enter it under Settings → EHR Clients → Cerner.

Note: The Client ID is not a secret. It appears in every authorization URL and is visible to anyone. App identity is proven by the signed client_assertion JWT, and the authorization code is protected by PKCE.

Register your JWKS URI

After creating your Confidential app, Cerner provisions a System Account for it. Register your JWKS URI there so Cerner can verify the JWT assertions your backend sends to the token endpoint.

1. Navigate to:

https://cernercentral.com/system-accounts/{your-client-id}

Replace {your-client-id} with the client ID from step 7.

2. Under the JSON Web Key Set section, click Edit.

   

3. Enter the Medblocks Platform JWKS URI:

https://app.medblocks.com/api/auth/.well-known/jwks

4. Save. Cerner will fetch this public key set when verifying JWT assertions.

5. Enter the Client ID in the Medblocks admin panel under Settings → EHR Clients → Cerner.

Verify the endpoint is reachable before saving:

curl https://app.medblocks.com/api/auth/.well-known/jwks

It should return a JSON object with a keys array containing your RSA public key.

If you are self-hosting instead of using Medblocks Platform, generate and store your own private key, expose its public key as JWKS over HTTPS, and sign the client_assertion JWT with a kid that matches one of the keys in that JWKS.

Test with Cerner Sandbox

Cerner provides a sandbox environment per tenant. Each hospital has its own tenant_id embedded in its FHIR base URL.

Sandbox Endpoint Structure

You can discover these endpoints programmatically from the SMART configuration endpoint:

GET https://fhir-myrecord.cerner.com/r4/{tenant_id}/.well-known/smart-configuration

Activate Organizations

Unlike Epic’s USCDI v3 auto-distribution, Cerner does not have a global “mark ready for production” button that pushes your app to all organizations automatically.

Production access is per-organization. For each Cerner customer hospital you want to support:

1. Contact the organization’s Cerner integration or IT team
2. Provide them with:
   • Your Client ID
   • Your production redirect URI - https://app.medblocks.com/api/auth/smart/callback for Medblocks Platform
   • The list of scopes your app requests
3. They activate your app within their Cerner tenant configuration
4. Use their FHIR base URL to build your authorization request:

https://fhir-myrecord.cerner.com/r4/{their_tenant_id}

Once activated, patients at that organization can authenticate and pull their health records through your app.

Add the Source in Medblocks Platform

Once a Cerner organization has activated your app:

1. Navigate to Settings → EHR Clients → Cerner in the Medblocks admin panel
2. Enter your Client ID if you haven’t already
3. The organization’s FHIR base URL (https://fhir-myrecord.cerner.com/r4/{tenant_id}) needs to be added to the Medblocks FHIR sources database - contact Medblocks support to get this added for each new organization

Once the FHIR source is added, patients at that organization will see Cerner as a connect option in your app.