Skip to main content
This guide shows you how to obtain an OAuth client (Client ID & Client Secret) from MEDITECH to use with Nango. MEDITECH doesn’t offer a self-serve OAuth app console — a member of the Greenfield support team provisions your client manually, over a scheduled call.
1

Submit the Greenfield Workspace registration form

Fill out the Greenfield Workspace registration form. You’ll get immediate access to Greenfield’s documentation resources.
2

Sign the Greenfield EULA

A member of the Greenfield support team emails you a welcome packet with instructions for executing the Greenfield End-User License Agreement (EULA). Complete this before you can access the workspace.
3

Set up your Google ID

Greenfield Workspace access requires a Google account: it’s the identity provider for the Greenfield Portal and its documentation, and it links your test patients and OAuth flows in the sandbox. If your work email differs from your Google ID, provide MEDITECH both — the email is also needed for Jira Service Desk access.
If you have trouble signing in with your registered Google ID or can’t access the portal, email greenfieldinfo@meditech.com. This address is for access issues only.
4

Request your OAuth client

Provide the Greenfield support team with your redirect/callback URI: https://api.nango.dev/oauth/callback. They’ll schedule a brief call to hand you your Client ID and Client Secret — this isn’t issued automatically through the portal.
Store both values securely. You’ll enter them once when configuring the MEDITECH Greenfield integration in Nango, not per connection.
If you’d rather let each end user bring their own MEDITECH OAuth client instead of using the one configured on the integration, create the Connect Session with empty oauth_client_id_override and oauth_client_secret_override values. Connect UI then shows Client ID and Client Secret as fields the end user fills in themselves. See Create a connect session for the exact syntax.

​
Going to production

The Greenfield Workspace only gives you sandbox access with synthetic test patients — it isn’t a path to a live healthcare organization’s data. Each MEDITECH customer sets their own policies for connecting third-party applications to their system, so there’s no single MEDITECH-wide production onboarding process. To go live, contact the specific healthcare organization you want to integrate with; they in turn work with MEDITECH to register your client, since MEDITECH registers every application on the customer’s behalf — vendors never self-register. As part of that request, MEDITECH asks for the following (per MEDITECH’s Client Authentication requirements):
  • Client Name and Description — a short, user-facing name (≤50 characters) and a 1-2 sentence functional description of what your app does. These are shown to end users in Expanse’s consent dialogs.
  • Client type: Confidential. Nango’s backend holds the Client Secret and performs the token exchange on behalf of your app, so it’s a confidential client — not a public client (browser/mobile apps with no secret storage) and not a Backend Services client (non-interactive system-to-system access with Private Key JWT, which doesn’t apply here since end users authenticate interactively).
  • Authorization model: Authorization Code with OpenID Connect (OIDC) — the interactive, user-facing model, since a provider or patient signs in through MEDITECH’s login. Don’t request the Backend Services (Private Key JWT) or legacy Client Credentials (client secret) models — MEDITECH restricts those to non-interactive and internal/legacy use, not vendor integrations.
  • Redirect URI: https://api.nango.dev/oauth/callback, registered exactly (no wildcards). Production requires an HTTPS redirect URI — localhost and other non-HTTPS URIs are only permitted in the Greenfield sandbox and on-site TEST environments.
  • Requested scopes — the SMART on FHIR scopes your workflow needs (e.g. patient/*.read), following least privilege.
End users authenticate with the credentials their healthcare organization already uses to sign into MEDITECH Expanse (via that organization’s own identity provider — ADFS, Azure AD/Entra ID, Okta, etc.). MEDITECH doesn’t manage those accounts or enforce MFA itself; that’s entirely up to the organization’s identity provider. For more details, see MEDITECH’s Greenfield Workspace resources. Once you have your Client ID and Client Secret, see the connect guide for how to find the matching Authorization Host and FHIR API host and finish connecting in Nango.