OAuth 2.1 and PKCE: Safe, Revocable AI Access to Your Medical Account

Hi-Doctor integrates Model Context Protocol (MCP) technology through an OAuth 2.1 authorization-code flow with Proof Key for Code Exchange (PKCE) to ensure secure AI connectivity. This standard allows external AI assistants to access strictly scoped account functions without ever receiving, storing, or viewing your account password. Clinical authority remains entirely untouched: an EU-licensed doctor evaluates every medical submission and retains exclusive power to prescribe or alter treatment.

Key takeaways

• Zero password exposure: OAuth 2.1 with PKCE authenticates your session directly on Hi-Doctor servers, so third-party AI clients never handle your login credentials.
• Granular tool permissioning: Access is controlled across 50 discrete tools, allowing you to grant or withhold specific functional permissions at any point.
• Total clinical separation: AI assistants can assist with formatting questionnaire answers or reading prescription status, but cannot approve consultations, issue prescriptions, or adjust doses.
• Instant revocability: You can disconnect your assistant instantly from your account dashboard, immediately invalidating active access tokens.

What is OAuth 2.1 with PKCE, and why does healthcare authorization require it?

Modern web security demands that sensitive applications separate authentication credentials from API access. OAuth 2.1 represents the latest consolidation of authorization standards, removing vulnerable legacy flows and mandating strict security controls for client applications.

Proof Key for Code Exchange (PKCE) adds an extra cryptographic layer specifically designed to prevent authorization code interception attacks. When an AI assistant initiates a connection, it generates a secret code verifier and sends a transformed version (the code challenge) to Hi-Doctor's authorization server.

Because the authorization server validates this cryptographic proof before issuing tokens, authorization codes cannot be intercepted or reused by unauthorized entities on your device. This architecture ensures your medical communication environment remains protected under strict European cybersecurity standards.

How does the OAuth 2.1 authorization flow work step-by-step?

The authorization process establishes a secure link between your preferred AI assistant and your Hi-Doctor account in a few steps. You are presented with a transparent consent screen detailing the exact permission scopes requested before any access token is generated.

The process moves directly from authentication on Hi-Doctor's domain to token exchange via standard HTTPS endpoints, guaranteeing complete isolation of credentials. The sequence below demonstrates how data and authorization signals move through the architecture.

1. The assistant requests authorization, sending a PKCE code challenge (S256) with its registered redirect URI.
2. You sign in on a Hi-Doctor page — the AI client never sees your password.
3. You approve the specific permission scopes shown on the consent screen.
4. Hi-Doctor returns a single-use, short-lived authorization code to the redirect URI bound to that client.
5. The client exchanges the code plus its PKCE verifier for a short-lived access token limited to the scopes you approved.
6. Each tool call is forwarded to the Hi-Doctor API as you; a scope you did not grant is not offered at all.

Once authenticated, the AI client receives a short-lived access token bound strictly to the scopes you approved. If a requested tool scope was not granted, the backend endpoint refuses to expose the tool to the assistant client entirely.

Scope permissions: What can an AI assistant do—and what is strictly forbidden?

Hi-Doctor's hosted MCP server at https://mcp.hi-doctor.ai/mcp exposes up to 50 tools grouped into explicit permission boundaries. This design ensures that administrative convenience never compromises patient safety or data sovereignty.

Crucially, clinical decision-making capabilities do not exist within the tool surface exposed to any AI. The system architecture makes it programmatically impossible for an AI model to evaluate medical eligibility or issue a prescription.

Permission Scope	Allowed AI Assistant Capabilities	Strictly Forbidden Actions (Doctor-Only)
Profile & Account	Read profile data, view contact preferences	Alter core identity records or medical history logs
Questionnaires	Draft questionnaire responses conversationally	Pre-approve eligibility, diagnose, or submit clinical review
Prescriptions & Status	Read active REMPE PDF status and order history	Issue, modify, renew, or approve prescriptions
Medical Team Messages	Draft asynchronous messages to medical inbox	Conduct live clinical chat, override clinical decisions
Weight-Loss Tracking	Log weight-loss progress metrics	Log non-weight health metrics, modify medication dosage
Payments	Generate secure Stripe checkout links	Handle raw payment card data or process direct refunds

Patients retain complete control to review every drafted response before final submission. Resubmitting different answers through an assistant does not bypass backend clinical rules enforced by Hi-Doctor.

Revoking access and data security standards

Security is effective only when access control is bidirectional. In addition to robust authentication during setup, Hi-Doctor provides single-click revocation through your secure account dashboard.

Revoking an AI connection immediately invalidates active access tokens and refresh tokens on the server. The AI client loses all access to account endpoints instantly without affecting your ongoing consultations or historical records.

"An AI assistant cannot approve a consultation, issue or change a prescription, or alter a dosage. Clinical governance remains 100% human."

Furthermore, payment processing relies entirely on Stripe hosted checkout links. The AI connector never touches credit card numbers, billing addresses, or card verification codes, maintaining strict PCI-DSS compliance boundaries.

How Hi-Doctor protects your clinical decisions

Hi-Doctor provides dedicated online doctor consultations across specific treatment areas: Hair Growth, Weight Loss, Sexual Health, Premature Ejaculation, Chlamydia, Urinary Tract Infections, Emergency Contraception, and HIV PrEP.

Every consultation submitted through our platform—whether completed via the web interface or conversationally through an AI assistant—is assigned directly to an EU-licensed doctor for asynchronous review. There are no video calls, telephone appointments, or live chat obligations.

Doctors review the submitted medical questionnaire and, when clinically appropriate, issue the prescription in under 24 hours. Prescriptions are issued using Spain's official REMPE private electronic-prescription format, carrying full cross-border compliance fields designed for recognition across EU member states.

Consultation fees are completely transparent: €25 for Hair Growth and Weight Loss (subscription model for ongoing care) and €35 as a one-off fee for other treatment categories. If the doctor determines that treatment is clinically inappropriate and declines the request, your consultation fee is refunded in full alongside detailed medical guidance.