Your users' health records are scattered. Ask for them once.

How it works

Three steps to a working connection

1. Register your app

   In the developer portal, create an app with a display name and your redirect URI bases: https for production, http://localhost for development. Choose a public client (PKCE, client ID only) or a confidential client (client ID plus a secret that is shown once).

   • display_name shown on the consent screen
   • redirect_uris one base per line
   • description, logo_url optional
   • privacy and terms URLs optional, shown to people

2. Send people to consent

   Link to the authorize endpoint with a random state, a PKCE challenge and resource set to Triangle's MCP endpoint, so the token works there. People sign in to Triangle, pick the profile to share from, and approve the scopes you asked for.

   authorize.js

   // keep the verifier in the user's session
   const verifier = randomString(64);
   const challenge = base64url(await sha256(verifier));
   const params = new URLSearchParams({
     client_id: CLIENT_ID,
     redirect_uri: CALLBACK,
     response_type: "code",
     scope: "patient:read labs:read",
     state,
     code_challenge: challenge,
     code_challenge_method: "S256",
     resource: "https://app.trianglehealth.com/mcp",
   });
   location.href = `https://app.trianglehealth.com/oauth/authorize?${params}`;

3. Exchange the code, then call Triangle

   Trade the code for an access token and a refresh token. Today you call Triangle's MCP server with the token, using JSON-RPC methods such as tools/list and tools/call. Full HTTP API documentation is coming soon.

   token.sh

   # exchange the code
   curl -X POST https://app.trianglehealth.com/oauth/token \
     -d grant_type=authorization_code -d code=$CODE \
     -d redirect_uri=$CALLBACK -d client_id=$CLIENT_ID \
     -d code_verifier=$VERIFIER
   
   # list what the token can do
   curl -X POST https://app.trianglehealth.com/mcp \
     -H "Authorization: Bearer $ACCESS_TOKEN" \
     -H "content-type: application/json" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

What you get

A person's health history, with their permission

Trust

What your users can count on

• Their data is never sold or shared for advertising.
• They decide what to share and with whom, and can disconnect your app at any time.
• No drug maker, laboratory or hospital pays Triangle. The people who pay are members.
• Everything is encrypted, and their records are theirs to delete.
• Triangle is HIPAA compliant; details are in its Trust Center.
• Triangle is listed in the Medicare App Library.

Triangle provides research and educational support. It does not diagnose, treat, or prescribe, and it never replaces your care team.