Wiring Up SMART on FHIR OAuth2 Between OpenEMR and a Python Microservice Locally

If you're building a service on top of OpenEMR locally, at some point you need to stop bypassing auth and wire up real token validation. OpenEMR ships with a full SMART on FHIR OAuth2 server — but the documentation for connecting a custom microservice to it is scattered, and the gotchas are real. The most authoritative documentation on it is here and it doesn't cover all the pitfalls. This post walks through exactly what it takes to connect a Python FastAPI service to OpenEMR's OAuth2 system, using token introspection to validate incoming requests. We'll cover both patient and staff access with separate scopes and enough detail that you don't have to rediscover the same pitfalls. The System Here's the setup: Service Tech Port openemr OpenEMR 7.0.4 (PHP + Docker) 8300 (HTTP), 9300 (HTTPS) ai-agent Python FastAPI + LangGraph 8000 Both run in Docker Compose. The OpenEMR container is internally reachable at http://openemr — which matters because your server-to-server calls (token introspec