Authentication & tokens

OAuth 2.0 client credentials. Your organisation's administrator creates a client in Norvya and receives the secret once; Norvya stores only a hash. Tokens last about 15 minutes, carry only the scopes you request, and stop working the moment the client is revoked.

curl -s https://norvya.fly.dev/v1/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=$NORVYA_CLIENT_ID -d client_secret=$NORVYA_CLIENT_SECRET \
  -d scope="members.read"

The token endpoint is documented in the Platform reference. EMR vendors: see EMR vendor tokens.