Authentication method for signing an e-prescription

The authentication method used is oAuth2. The detailed documentation on how to implement the oAuth2 service from HIN can be found in the document: https://download.hin.ch/documentation/oAuth2_Dokumentation_en.pdf The following step-by-step instructions explain how to create and sign an e-prescription:

Please pay attention to the URLs that they are case sensitive:

1. An oAuth2 auth code is required, which can be obtained in two different ways:
   Option 1: navigate to https://apps.hin.ch -> ID Delegation für «HIN Authservice INT» resp. «HIN Authservice» or
   Option 2: using the URL via browser (the redirect_uri is determined by you and must be communicated to HIN Support)

http://apps.hin.ch/REST/v1/OAuth/GetAuthCode/hin_authservice_int?response_type=code&client_id=<client_id>&redirect_uri=http%3A%2F%2Flocalhost%2FgetAccessToken

2. Convert the oAuth2 code to a bearer token using the following command:

curl -H "Content-Type: application/x-www-form-urlencoded" --data "grant_type=authorization_code&redirect_uri=http%3A%2F%2Flocalhost%2FgetAccessToken&code=<auth_code>&client_id=<client_id>&client_secret=<client_secret>" https://oauth2.hin.ch/REST/v1/OAuth/GetAccessToken

ATTENTION

redirect_uri must be empty if the auth code was copied manually from apps.hin.ch.

3. Perform Login:

curl --request POST --url 'https://oauth2.authservice-int.hin.ch/v1/oauth?targetUrl=http%3A%2F%2Flocalhost%2Fsuccess&style=redirect' --header 'accept: application/json' --header 'Authorization: Bearer {...}'

4. paste the URL into your browser and copy the auth code

5. now convert the auth code into an auth handle:

curl --request POST --url 'https://oauth2.authservice-int.hin.ch/v1/oauth/auth_handle' -H 'accept: application/json' --header 'Authorization: Bearer {...}' -H 'Content-Type: application/json' -d '{"authCode": "{...}"}'

6. Returned Auth Handle:

{
 "authHandle":"wnVQZ54aG3348lxUO5tw"
}

Using the oAuth/JWT Tokens: These 2 options to transmit the token are possible:

• as a prefix in the authorization header: --header 'Authorization: Bearer acs:{bearer token}'
• as a separate header (adhering to the oAuth standard): --header 'Token-Type: HIN_ACS' --header 'Authorization: Bearer {bearer token}'

The values are accepted for the token-type header:

• OAUTH: for the signing process
• HIN_JWT: for the dispense process using an OVAN ID
• HIN_ACS: for the dispense process using a HIN ID

Environment variables

Identifier	TEST	PROD
token group	hin_authservice_int	hin_authservice
ServiceUrl	oauth2.authservice-int.hin.ch/v1/oauth/auth_handle	oauth2.authservice.hin.ch/v1/oauth/auth_handle