Subject: SMART on FHIR Launch Sequence Error - launch:code-requiredDear Cerner Developer Support Team,We are experiencing a persistent authorization error when launching our SMART on FHIR application from the Cerner sandbox environment. Despite comprehensive troubleshooting and adherence to all documented standards, we continue to receive the following error:
Basic Information:
- Client ID: f010a897-b662-4152-bb22-b87bcd3cba54
- Application Type: Public Client
- Launch URI: https://smart-calc-dot-fhir0730.df.r.appspot.com/launch
- Redirect URI: https://smart-calc-dot-fhir0730.df.r.appspot.com/callback
Error Details:
- Error Code: urn:cerner:error:authorization-server:smart-v1:grant:launch:code-required
- Error Instance: 847e48ff-956f-4f96-8585-2d0ccb19d40a
- Tenant: ec2458f2-1e24-41c8-b71b-0e701af7583d
- Error Context: persona=provider&client=908d5cee-a54b-434d-847a-9765a9df9c53&tenant=ec2458f2-1e24-41c8-b71b-0e701af7583d
Technical Implementation Confirmed:
✅ SMART on FHIR Compliance: Using standard SMART App Launch 2.0 workflow✅ PKCE Implementation: Correctly implemented with S256 method✅ Endpoint Discovery: Using .well-known/smart-configuration for authorization endpoints✅ Required Parameters: Including all mandatory parameters: launch, aud, intent, state, code_challenge✅ Client Registration: Registered as Public Client (no client_secret)✅ API Permissions: Patient Product APIs configured with appropriate Read permissions✅ Scopes: launch/patient openid fhirUser profile patient/Patient.read patient/Observation.read patient/Condition.read patient/MedicationRequest.read online_access
Troubleshooting Completed:
- Application Configuration: Verified all environment variables and deployment settings
- Security Headers: Removed conflicting X-Frame-Options header for iframe compatibility
- PKCE Implementation: Validated code verifier and challenge generation
- Scope Validation: Ensured scopes match application registration
- Launch Token Handling: Confirmed proper capture and inclusion of launch token
- API Permissions: Configured Patient Product APIs with Read access
- Intent Parameter: Added explicit intent=launch parameter
Request for Assistance:
We have completed comprehensive troubleshooting and our implementation follows all SMART on FHIR standards and Oracle Health documentation. The application code is standards-compliant, yet we consistently receive the launch:code-required error immediately upon authorization request.Could you please:
- Review the server-side logs for our Client ID to identify the specific missing "code" requirement
- Clarify what additional parameters or configuration changes are needed for the launch grant type
- Confirm if there are any sandbox-specific requirements not covered in the standard documentation
We would greatly appreciate your assistance in resolving this issue so we can proceed with our SMART on FHIR integration.Thank you for your support.
Best regards,
Lu
aluminum001@gmail.com