{
  "id": 7478396,
  "title": "Patient Portal OAuth Login: Explicit Consent and Refresh Token Rotation in Node.js",
  "url": "https://urgent.news/2026/09/15/patient-portal-oauth-login-explicit-consent-and-refresh-token",
  "topic": "health",
  "section": "Health & Medicine",
  "published": "2026-09-15T04:56:16.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/linusholm3764/patient-portal-oauth-login-explicit-consent-and-refresh-token-rotation-in-nodejs-3kp0"
  },
  "original_language": "en",
  "account": null,
  "summary": "The article discusses the considerations for implementing OAuth login and explicit consent mechanisms in a patient portal using Node.js. It recommends treating identity, consent, and session lifetime as separate decisions, and suggests using a managed provider for its policy controls and recovery workflow, or a programmable option when tighter control of token rotation and audit events is required. The author emphasizes the importance of explicit consent before accessing protected data, providing an example of a concrete request for medication history versus a vague request for \"improve your experience.\" The article also covers the need for audit records capturing consent state transitions, and the implementation of refresh token rotation as part of the same operational story. Finally, it provides a small Node.js code example demonstrating how to check consent before a data read and implement an explicit session revoke path.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}