Authenticated Embedded Partner Integrations
Harbor partners can now embed their experience natively inside Healthie — appearing as a custom tab directly within the patient profile. Providers access partner tools with no second login, no tab switching, and full patient context passed automatically.
Built by Core Engineering
The problem it solves
Today, even when a partner application is embedded inside Healthie, providers must log into that application separately — breaking the care experience and limiting how deeply partners can integrate with Healthie's data. Switching between tools and managing multiple sessions creates friction that reduces partner adoption and undermines the value of the integration.
What's included
- Custom tab embedded directly within the Healthie client profile — appears alongside native tabs with a partner-provided label
- Automatic provider authentication via secure, short-lived JWTs — no second login required
- Silent token refresh in the background for as long as the tab is open
- Optional patient context passed to the partner app at load time — partner surfaces the right patient automatically
- Scoped, time-limited API access for the partner to call the Healthie API on the logged-in provider's behalf
How it works
Setup is configured once per organization by the Healthie partnerships team — the partner app's URL and tab label are registered in Healthie. When a provider opens the partner tab within a client profile, Healthie generates a short-lived JWT (signed with RSA keys managed via AWS KMS) and delivers it to the partner app via postMessage — never via URL parameters or cookies, which would expose tokens in browser history and server logs. The partner app listens for the HEALTHIE_JWT_TOKEN message, stores the token, and uses it as a Bearer token with an AuthorizationSource: ThirdPartyApp header to make authenticated GraphQL requests to the Healthie API. Tokens are valid for 15 minutes. Healthie proactively sends a fresh token ~60 seconds before expiry (silent: true); the partner app can also request an on-demand refresh by posting TOKEN_EXPIRED back to the parent frame. If configured, an optional patient_id claim is cryptographically bound to the token so the partner app can load the correct patient context automatically. Currently available to Enterprise customers — reach out to your Healthie partnerships contact to enable.
Example configuration
Authenticated Embedded Partner Integrations lets Harbor partners embed their product natively inside Healthie, appearing as a custom tab within the patient profile. It's built for partners who want a connected experience without asking providers to manage a second login, and it's currently available to Enterprise customers in a controlled rollout. When a provider opens the tab, Healthie automatically issues a short-lived encrypted credential so the partner app recognizes the logged-in provider instantly. Patient context can optionally be passed at the same time, so the right patient loads automatically.
