Authentication

Sign inCopy Anchor Link

LoginResult result = ovok.auth().login(new LoginCredentials(
        ProfileType.PRACTITIONER, "person@example.com", password));

if (result.status().equals("mfa-required")) {
    result = ovok.auth().verifyMfa(result.challenge(), mfaCode);
}
Session session = result.session();

Sign-in uses PKCE. ProfileType is PATIENT, PRACTITIONER, or RELATED_PERSON. LoginResult.status() is signed-in or mfa-required.

Sessions and refreshCopy Anchor Link

The client stores the session in its session storage and refreshes the access token before it expires. An authenticated request that answers 401 refreshes once and retries.

When the token service rejects the refresh token, the client clears the session and passes an UnauthenticatedReason to the onUnauthenticated callback.

A backend service signs in with client credentials instead; see machine clients.

Every method is in the AuthResource reference.