Exchange an authorization code for tokens, refresh a token, or obtain a client_credentials token. The same endpoint serves both interactive apps and Bulk FHIR backend services — which fields you send depends entirely on your grant_type.

authorization_code / refresh_token (interactive apps)

Send client_id/client_secret in the body (client_secret_post).

client_credentials (Bulk FHIR / backend services)

No client_secret — authentication is private_key_jwt instead:

• Send client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer and a client_assertion JWT, signed with the private key matching the public JWKS your client is registered with.
• Assertion claims: iss/sub = your client_id, aud = this token endpoint URL, plus jti/iat/exp (a short expiry — 5 minutes is typical).
• Signing algorithm confirmed working: ES384.
• scope is required on this grant (space-separated system/*.rs scopes) — it's not implied the way it can be for the other two grants.

The schema below lists every field used across all three grants; see above for which combination applies to yours.

{
  "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
  "scope": "system/Patient.rs system/Observation.rs"
}

{
  "token_type": "Bearer"
}