FHIR server base URL — used for validateBaseUrl and exposed as provider.baseUrl.
Called on every request to retrieve the current session.
Called whenever the provider obtains a new session (after refresh). The host must persist it.
OptionalgetResolves the confidential client secret server-side. Required when sessions use usesClientSecret.
OptionaltokenRefresh the token this many seconds before expiry (default: 30).
Configuration for
SmartAppLaunchAuthProvider.The provider holds no session state of its own — it asks the host for the current session on every request via
getSession, and reports refreshed sessions back viasetSession. This makes the host's session store the single source of truth and avoids cache-coherence bugs across multiple provider instances or processes.