What is SMART Flint?

SMART Flint helps applications connect to FHIR systems without rebuilding the supported SMART authorization and connection lifecycle for every installation. It runs in your environment and manages launch orchestration, tenant connections, OAuth grants, launch context, and optional FHIR access mediation. Your application keeps its own user experience and can use its preferred FHIR client.

Version 0.1 is a working foundation. The included EHR environments are synthetic protocol simulators. They demonstrate routing, launch, and access behavior; vendor names in those fixtures do not establish compatibility or certification with real Epic, Oracle Health, MEDITECH, or any healthcare organization.

Where it fits

In an interactive integration, the application connects through a configured installation. SMART Flint orchestrates authorization against that installation’s EHR connection, checks the required scopes and launch context, then delivers an activation for that application session. The activation identifies a specific connection and context; an activation ID by itself is not a credential.

After authorization, you choose how FHIR requests travel:

Mode	FHIR request path	Who manages renewal?
Gateway	Application → SMART Flint → EHR	SMART Flint
Direct	Application → original EHR FHIR endpoint	SMART Flint supplies current upstream access credentials
Handoff	Application → original EHR FHIR endpoint	Application after an explicit compatible ownership transfer

SDK use and gateway use are independently optional. The TypeScript and Python SDKs are convenience clients for the HTTP API. An ordinary FHIR client can use the supplied base URL and authorization provider. See access modes.

Supported integration pathways

• EHR-initiated SMART launch: accept an EHR launch, establish the application’s own browser transaction, and deliver the validated activation after authorization.
• Standalone SMART launch: begin from an application, using an installation to resolve the configured organization and upstream FHIR connection.
• SMART Backend Services: obtain pre-authorized system access using asymmetric JWT client authentication and a server-held application API credential.
• Synchronous CDS Hooks: validate configured signed callers, bind context and prefetch to the request, and forward to an authenticated private handler.

The service also provides encrypted storage for upstream tokens, private keys, clinical context, and authorization transactions; named local or OIDC administrators; scoped administrative roles; registration worksheets; launch activity; bounded retention; and operational maintenance commands.

What it does not replace

An EHR vendor and customer still need to register, authorize, and enable your application. Your application still controls its clinical behavior, end-user experience, own authorization, and proper treatment of patient data. Discovery status Verified means metadata was checked; it does not mean a complete application pathway has passed end-to-end qualification.

The current gateway supports metadata, JSON resource reads, version reads, and searches. Clinical writes, arbitrary FHIR operations, Bulk Data export, multi-server grants, full FHIR-version conversion, FHIRcast, SMART Web Messaging, and an independently conformant downstream SMART authorization server are future work. Sender-constrained grants require a compatible proof mechanism and are rejected by this release.

Choose a starting point

1. Download and install for a Docker-only sandbox with guided setup.
2. Follow the local quickstart to complete a synthetic launch and try the samples.
3. Learn the workspace model before configuring your application’s integration.
4. Use the application integration guide, backend guide, or CDS Hooks guide for your pathway.
5. Review deployment, security, and operations before a persistent installation.

Source-available licensing

The SMART Flint Community License v1.0 grants eligible users rights to inspect, run, modify, and distribute covered software, including use in proprietary products. It is source available, not an OSI-approved open-source license. Qualifying businesses must have Organization Group annual gross revenue strictly below USD 5 million; organizations at or above that amount need a commercial license unless another eligibility exception applies. Eligible nonprofit and public academic/research use has its own conditions.

Read the licensing explanation and controlling license. Eligibility, redistribution, evaluation, and transition terms matter; a source download does not remove them.

Source references: project README, architecture, and license.