Skip to main content

​
1. The clinic provisions the account

A practice administrator creates a new EHR user account for the integration: a username and a starting password, with multi-factor authentication required per the practice’s policy. Any clinic can do this; nothing about their process changes.

​
2. Do not log in

A brand-new eClinicalWorks account requires first-login steps: selecting a security image, resetting the password, and enrolling multi-factor authentication. None of these should happen. The account must reach Cobalt in its fresh, never-logged-in state, because Cobalt performs the activation itself. If an account has already been logged into before connecting, contact us before proceeding.

​
3. Connect it to Cobalt

Use any of the standard connection methods, and have whoever holds the credentials enter them:
  • Send a Link URL from the Cobalt dashboard directly to clinic staff, so the credentials never pass through your team
  • Embed Cobalt Link in your own product with the React client
  • Use the API to create a Link token and drive the flow yourself
Mark the connection as managed when you create it: check Managed account in the dashboard’s send-link form, or set the managed flag when creating the Link token via API.

​
4. Cobalt takes it from there

Cobalt activates the account (the first-login steps above), enrolls multi-factor authentication, and rotates the password, so the connection runs on a credential that only Cobalt holds. From then on, passwords rotate ahead of every expiry policy and MFA stays managed. Syncing begins as soon as the connection is live.