# Fhir API Client Security

> Security review for plugins acting as FHIR API clients - token management, scope validation, and patient-scoped authorization

- Skill: `canvas-medical/fhir-api-client-security` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add canvas-medical/fhir-api-client-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/canvas-medical/fhir-api-client-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: canvas-medical (https://skillmd.com/u/canvas-medical)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/canvas-medical/fhir-api-client-security

---


# FHIR API Client Security Skill

This skill provides security review guidelines for Canvas plugins that act as FHIR API clients. Use it to audit token management, scope usage, and patient-scoped authorization when your plugin calls Canvas FHIR APIs or external FHIR endpoints.

## When to Use This Skill

Use this skill when:
- Plugin uses `Http()` to call FHIR APIs
- Plugin uses Canvas SDK data models (`Patient.objects`, etc.)
- Plugin implements SMART on FHIR integration
- Plugin has patient-facing features that access FHIR data
- Reviewing OAuth token scope declarations

## Key Security Concerns

1. **Token Scope** - Request minimum necessary scopes (least privilege)
2. **Patient-Scoped Tokens** - Patient-facing apps MUST scope tokens to the specific patient
3. **Token Storage** - Tokens in secrets, never hardcoded
4. **Token Leakage** - Never log tokens or include in error messages

## Security Checklist

Reference the `fhir_client_context.txt` file for detailed patterns including:
- OAuth authentication methods
- FHIR scope format and common scopes
- Patient-scoped token requirements
- Token storage best practices
- Common vulnerabilities and detection