Know every customer in an instant.
With one connection.

1. Day 09:02

   She signs in. Your agent knows who she is.

   Signed in with AllClear

   Your agentPOST /tokenGET /userinfoa verified person

   Your agentHi Priya. You're verified and your records are connected. What do you need?
   Show the call

   POST https://oauth.app.allclearid.com/token
   
   { "access_token": "<token>",
     "id_token": "<JWT>", "expires_in": 3600 }
   
   // id_token: who she is, not her data
   { "iss": "https://oauth.app.allclearid.com",
     "sub": "<stable per-client subject>",
     "aud": "<your client_id>",
     "auth_time": 1788854719,
     "at_hash": "<hash of the access token>" }
   
   // her details, as far as your scopes reach
   GET https://oauth.app.allclearid.com/userinfo
   Authorization: Bearer <the same access token>
   
   { "sub": "<the same subject>",
     "name": "Priya Williams", "birthdate": "1967-06-13" }

2. Day 09:03

   She asks a question. Your agent answers from her record.

   What am I taking for my blood pressure?

   Your agenttools/call get_medications1 record, 1 note excerpt

   Your agentAmlodipine, 5 mg once a day. Your progress note from January 15 says: BP 148/92 at last visit; continue current regimen.
   Show the call

   POST https://mcp.app.allclearid.com/mcp
   Authorization: Bearer <the same access token>
   
   { "method": "tools/call",
     "params": { "name": "get_medications",
                 "arguments": { "status": "active" } } }
   
   // 1 structured record, 1 excerpt from a progress note
   Amlodipine 5 mg · once daily · active
   "BP 148/92 at last visit; continue current regimen."

3. Between sessions

   AllClear keeps collecting. Her record fills in.

   Portals and loginsFax-only officesPhone treesMailed paperIdentity checksDenials

   Riverside Family Medicine

   Fax-only office. Records request sent, verified identity attached.

   Riverside Family Medicine

   Phone follow-up. Records released, structured on intake.

   Northgate Labs

   Portal connected. New results arrive as they post.

   Your agenttools/call list_connections3 providers, up from 2
   Show the call

   // what your agent sees, before and after
   { "method": "tools/call",
     "params": { "name": "list_connections" } }
   
   // day 0
   [ "Bayview Medical Group", "Northgate Labs" ]
   
   // day 2
   [ "Bayview Medical Group", "Northgate Labs",
     "Riverside Family Medicine" ]

4. Day 216:40

   New labs land. Your agent notices before she asks.

   AllClearrecord.addedYour agentGET /events/{id}tools/call get_lab_resultsthe new results

   Your agentYour new labs from Riverside came in overnight. Everything is in range except the blood pressure reading, which is still high. Want me to flag it for your next visit?

   Yes, please.
   Show the call

   // a thin signed notification: an event id and type, no user
   POST https://yourapp.example/hooks
   { "type": "event_notification",
     "event": { "id": "<uuid>",
                "type": "record.added" } }
   
   // your app's own credential fetches it, and the event
   // names the patient it is about
   GET https://api.app.allclearid.com/events/<uuid>
   Authorization: Bearer <your client access token>
   
   // now you know whose it is: her token reads the results
   { "method": "tools/call",
     "params": { "name": "get_lab_results" } }

5. Day 311:15

   She asks for the original. Your agent pulls the PDF.

   Can you send me the actual lab report? My new doctor wants it.

   Your agentGET /records/{id}the original PDF

   Your agentHere's the original PDF from Riverside, exactly as they released it. Want me to forward it to Dr. Okafor's office too?
   Show the call

   // the source document, in its original form
   GET https://api.app.allclearid.com
       /patients/<id>/records/<record id>
   Authorization: Bearer <the same access token>
   
   {
     "file_name": "riverside-labs-2026-03-02.pdf",
     "file_type": "application/pdf",
     "download": { "url": "<signed URL>",
                   "expires_at": "<ISO 8601>" }
   }

6. Day 918:00

   Her appointment is tomorrow. Your agent follows up.

   Your agenttools/call get_medicationstools/call get_lab_resultsPOST /recordsa summary in her account

   Your agentYour appointment with Dr. Okafor is tomorrow at 10. I put a one-page summary of the new labs and your current medications in your AllClear account, ready to share.

   Perfect, thank you.
   Show the call

   // her token reads what changed since day 2
   { "method": "tools/call",
     "params": { "name": "get_medications" } }
   { "method": "tools/call",
     "params": { "name": "get_lab_results" } }
   
   // and writes the summary back into her account, so her
   // doctor can be shown it (shape illustrative)
   POST https://api.app.allclearid.com
        /patients/<id>/records
   Authorization: Bearer <the same access token>
   { "file_name": "visit-prep-2026-03-09.pdf",
     "source": "Your Agent" }

Solid: on the token she granted. Dashed: the event stream, on your app's own credential.

Everything she needed came from the one connection she granted on day zero: nothing new to integrate, nothing new to ask her.

What your user sees.

It is OAuth. Your web page or native app sends the user to AllClear. There, they see plainly what you're asking for — not a technical scope list, but a plain-language sentence like "This app wants to see your medications" — and they approve it with one tap. We redirect them back to your app, and your server exchanges the code for an access token behind the scenes. They can revoke that authorization any time from the AllClear app; when they do, your next call is refused.

1

oauth.app.allclearid.com

2

3

Real screens. The client shown is Claude, which connects this way today.

Frequently Asked Questions.