# Care Identity Service (CIS) **URL:** https://developer.community.nhs.uk/c/cis/22.md [Latest](https://developer.community.nhs.uk/latest.md) · [Categories](https://developer.community.nhs.uk/categories.md) · [Tags](https://developer.community.nhs.uk/tags.md) --- ## [About the Care Identity Service (CIS) category](https://developer.community.nhs.uk/t/about-the-care-identity-service-cis-category/484)
**Author:** [@akunna.ndubuisi1](https://developer.community.nhs.uk/u/akunna.ndubuisi1)\ **Replies:** 1\ **Last updated:** [23 June 2025 17:32 UTC](https://developer.community.nhs.uk/t/about-the-care-identity-service-cis-category/484 "2025-06-23T17:32:26Z")
Care Identity Service (CIS) is a secure authentication and identity service that allows health and social care workers to access the systems they need, including access to patient information and clinical data. With the… --- ## [Idle timeout/explicit sign-out](https://developer.community.nhs.uk/t/idle-timeout-explicit-sign-out/15447)
**Author:** [@Duncan\_James](https://developer.community.nhs.uk/u/Duncan_James)\ **Replies:** 0\ **Last updated:** [2 October 2026 13:13 UTC](https://developer.community.nhs.uk/t/idle-timeout-explicit-sign-out/15447 "2026-10-02T13:13:47Z")
When implementing explicit sign-out and idle timeout, is it recommended to make a request to the CIS2 end\_session\_endpoint as well or is it enough to clear the user’s local CIS2 authentication session so they need to rea… --- ## [Command Line Documentation](https://developer.community.nhs.uk/t/command-line-documentation/14453)
**Author:** [@jim.brock](https://developer.community.nhs.uk/u/jim.brock)\ **Replies:** 0\ **Last updated:** [18 August 2026 08:14 UTC](https://developer.community.nhs.uk/t/command-line-documentation/14453 "2026-08-18T08:14:57Z")
Hi, Can anyone point me in the direction of the Robotic Authenticator client command line documentation please. The command line options are mentioned in the Quick Start guide, but these notes don’t have sufficient deta… --- ## [CIS2 Combined Authentication Selected Role](https://developer.community.nhs.uk/t/cis2-combined-authentication-selected-role/14219)
**Author:** [@Duncan\_James](https://developer.community.nhs.uk/u/Duncan_James)\ **Replies:** 3\ **Last updated:** [11 August 2026 09:52 UTC](https://developer.community.nhs.uk/t/cis2-combined-authentication-selected-role/14219 "2026-08-11T09:52:23Z")
We are implementing CIS2 using the User-restricted RESTful APIs - CIS2 combined authentication and authorisation security pattern as this is recommended for accessing user-restricted API’s. This is to authorise requests… --- ## [Awaiting Reply To Application to integrate with CIS2 Authentication](https://developer.community.nhs.uk/t/awaiting-reply-to-application-to-integrate-with-cis2-authentication/14039)
**Author:** [@clive.morris](https://developer.community.nhs.uk/u/clive.morris)\ **Replies:** 2\ **Last updated:** [4 August 2026 09:00 UTC](https://developer.community.nhs.uk/t/awaiting-reply-to-application-to-integrate-with-cis2-authentication/14039 "2026-08-04T09:00:24Z")
Hi I’ve been waiting 2 weeks for a response to our application to integrate with CIS2 Authentication. Is there a capacity problem? --- ## [Not being prompted to select roles even with selectedrole scope](https://developer.community.nhs.uk/t/not-being-prompted-to-select-roles-even-with-selectedrole-scope/13962)
**Author:** [@Jamie\_Burns](https://developer.community.nhs.uk/u/Jamie_Burns)\ **Replies:** 2\ **Last updated:** [3 August 2026 07:52 UTC](https://developer.community.nhs.uk/t/not-being-prompted-to-select-roles-even-with-selectedrole-scope/13962 "2026-08-03T07:52:58Z")
I am authenticating against the integration environment via CIS2 and I cannot seem to make the user select a role during login. I am specifying the ‘selectedrole’ scope, but when logging in, the user only sees these ste… --- ## [Guidance required for CIS2 INT environment authenticator allocation for test UUIDs](https://developer.community.nhs.uk/t/guidance-required-for-cis2-int-environment-authenticator-allocation-for-test-uuids/13927)
**Author:** [@Infohealth\_Dev](https://developer.community.nhs.uk/u/Infohealth_Dev)\ **Replies:** 0\ **Last updated:** [30 July 2026 11:17 UTC](https://developer.community.nhs.uk/t/guidance-required-for-cis2-int-environment-authenticator-allocation-for-test-uuids/13927 "2026-07-30T11:17:48Z")
We have successfully obtained test user UUIDs after contacting the ITOC team through the “Make a smartcard request for a Path to Live environment” process. We requested test users for the INT environment without physical… --- ## [Smartcard connect (Registry keys?)](https://developer.community.nhs.uk/t/smartcard-connect-registry-keys/13862)
**Author:** [@Tom\_Clegg](https://developer.community.nhs.uk/u/Tom_Clegg)\ **Replies:** 3\ **Last updated:** [29 July 2026 09:16 UTC](https://developer.community.nhs.uk/t/smartcard-connect-registry-keys/13862 "2026-07-29T09:16:54Z")
Hi All! bit of a longshot and apologies if this isn’t the appropriate forum for this but has anyone used the new NHS Smartcard Connect client and configured registry keys with this? I want to configure sessionlockpersi… --- ## [CIS2 auth tokens using jwt-bearer assertion type](https://developer.community.nhs.uk/t/cis2-auth-tokens-using-jwt-bearer-assertion-type/11789)
**Author:** [@David\_McDermott](https://developer.community.nhs.uk/u/David_McDermott)\ **Replies:** 11\ **Last updated:** [25 July 2026 13:29 UTC](https://developer.community.nhs.uk/t/cis2-auth-tokens-using-jwt-bearer-assertion-type/11789 "2026-07-25T13:29:11Z")
Hello, I am attempting to generate an access token using jwt-bearer assertion\_type, but I am getting back “client\_id is missing” (and later client\_secret is missing if I add the client\_id). If I supply a valid JWT as cl… --- ## [Unable to create RSA Public Key](https://developer.community.nhs.uk/t/unable-to-create-rsa-public-key/13488)
**Author:** [@alison.tant](https://developer.community.nhs.uk/u/alison.tant)\ **Replies:** 3\ **Last updated:** [15 July 2026 10:03 UTC](https://developer.community.nhs.uk/t/unable-to-create-rsa-public-key/13488 "2026-07-15T10:03:24Z")
I am trying to authenticate via CIS2 and I am getting the following response from our token request. ({“error\_description”:“Unable to create RSA Public Key”,“error”:“server\_error”}) (With a 500 code) This is this step… --- ## [Redirect URL cause CSP violation](https://developer.community.nhs.uk/t/redirect-url-cause-csp-violation/11442)
**Author:** [@steve.borman](https://developer.community.nhs.uk/u/steve.borman)\ **Replies:** 9\ **Last updated:** [25 June 2026 09:46 UTC](https://developer.community.nhs.uk/t/redirect-url-cause-csp-violation/11442 "2026-06-25T09:46:37Z")
I’m currently implementing CIS2 separate auth and have created a config in connection manager with a local host redirect. I can happily redirect and authenticate but then I end up on the authorize page with “Submit this… --- ## [Int - oAuth redirect\_uri\_mismatch](https://developer.community.nhs.uk/t/int-oauth-redirect-uri-mismatch/12207)
**Author:** [@Andrew\_Zagozda](https://developer.community.nhs.uk/u/Andrew_Zagozda)\ **Replies:** 3\ **Last updated:** [20 May 2026 09:19 UTC](https://developer.community.nhs.uk/t/int-oauth-redirect-uri-mismatch/12207 "2026-05-20T09:19:01Z")
I’ve set up a new INT application via the NHS Digital Onboarding website to test connectivity to e-Referral Service - Healthcare Worker ( Integration Testing ). My application connects to https://am.nhsint.auth-ptl.cis2… --- ## [Error: Missing or non-matching 'iss' claim in subject\_token JWT](https://developer.community.nhs.uk/t/error-missing-or-non-matching-iss-claim-in-subject-token-jwt/11870)
**Author:** [@ankur.mahto](https://developer.community.nhs.uk/u/ankur.mahto)\ **Replies:** 4\ **Last updated:** [12 May 2026 11:14 UTC](https://developer.community.nhs.uk/t/error-missing-or-non-matching-iss-claim-in-subject-token-jwt/11870 "2026-05-12T11:14:01Z")
Hi, We are attempting to do a token exchange between CIS2 and ERS, and as part of the process are submitting a subject\_token to e-RS which is the id\_token from CIS2. When we submit this, we get the following response: M… --- ## [Is it possible to have multiple API Access Tokens for one user?](https://developer.community.nhs.uk/t/is-it-possible-to-have-multiple-api-access-tokens-for-one-user/5874)
**Author:** [@sgroom](https://developer.community.nhs.uk/u/sgroom)\ **Replies:** 3\ **Last updated:** [10 May 2026 15:13 UTC](https://developer.community.nhs.uk/t/is-it-possible-to-have-multiple-api-access-tokens-for-one-user/5874 "2026-05-10T15:13:19Z")
Is it possible to have multiple API Access Tokens for one user? Our system allows one user to have multiple sessions open, these can span multiple web app servers; we’re trying to figure out token management regarding th… --- ## [CIS2 INT OIDC discovery failing with IDX20803 / IDX20807 – Unable to obtain configuration](https://developer.community.nhs.uk/t/cis2-int-oidc-discovery-failing-with-idx20803-idx20807-unable-to-obtain-configuration/12036)
**Author:** [@prince.sivan](https://developer.community.nhs.uk/u/prince.sivan)\ **Replies:** 2\ **Last updated:** [7 May 2026 12:39 UTC](https://developer.community.nhs.uk/t/cis2-int-oidc-discovery-failing-with-idx20803-idx20807-unable-to-obtain-configuration/12036 "2026-05-07T12:39:08Z")
Hi all, I am integrating NHS CIS2 Authentication (Separate Authentication & Authorisation) into a backend ASP.NET Core API for accessing PDS in the Integration (INT) environment, and I’d appreciate some guidance to conf… --- ## [CIS2 Separate Authentication](https://developer.community.nhs.uk/t/cis2-separate-authentication/11289)
**Author:** [@David\_Hobson](https://developer.community.nhs.uk/u/David_Hobson)\ **Replies:** 4\ **Last updated:** [30 April 2026 08:03 UTC](https://developer.community.nhs.uk/t/cis2-separate-authentication/11289 "2026-04-30T08:03:18Z")
I’m trying to test the separate authentication for CIS2. I followed the github tutorial to get started. I have obtained the keycloak credentials. When I try to run with the provided info, I get invalid redirect\_url as … --- ## [Including userinfo data in token response](https://developer.community.nhs.uk/t/including-userinfo-data-in-token-response/11790)
**Author:** [@David\_McDermott](https://developer.community.nhs.uk/u/David_McDermott)\ **Replies:** 3\ **Last updated:** [23 April 2026 12:38 UTC](https://developer.community.nhs.uk/t/including-userinfo-data-in-token-response/11790 "2026-04-23T12:38:55Z")
Is there a way to include userinfo in the cis2 access token response? Or is it required to make a second API request to the /userinfo endpoint? --- ## [Where to find configuration information](https://developer.community.nhs.uk/t/where-to-find-configuration-information/11409)
**Author:** [@steve.borman](https://developer.community.nhs.uk/u/steve.borman)\ **Replies:** 3\ **Last updated:** [23 April 2026 07:03 UTC](https://developer.community.nhs.uk/t/where-to-find-configuration-information/11409 "2026-04-23T07:03:39Z")
I am struggling to find what the correct configuration information is so I can test authentication in the Integration Test environment. I have created a configuration here: https://connectionmanager.nhsint.auth-ptl.cis2… --- ## [Use of CIS2 on Shared Mobile Devices](https://developer.community.nhs.uk/t/use-of-cis2-on-shared-mobile-devices/11528)
**Author:** [@JuhMed](https://developer.community.nhs.uk/u/JuhMed)\ **Replies:** 2\ **Last updated:** [23 April 2026 06:38 UTC](https://developer.community.nhs.uk/t/use-of-cis2-on-shared-mobile-devices/11528 "2026-04-23T06:38:45Z")
Hi, based on Care Identity Service authenticators - NHS England Digital shared devices are supported. What options are available when using an Android device which is organization owned and shared amongst users? I’ve u… --- ## [General Guideance -BackChannel](https://developer.community.nhs.uk/t/general-guideance-backchannel/601)
**Author:** [@MPye](https://developer.community.nhs.uk/u/MPye)\ **Replies:** 4\ **Last updated:** [15 April 2026 15:03 UTC](https://developer.community.nhs.uk/t/general-guideance-backchannel/601 "2026-04-15T15:03:07Z")
General question. Is supporting backchannel logout a hard requirement of integration with CIS2? Documentation to me does not explicitly state. I understand it’s benefits and we are openid connect, have support and wou… --- ## [Combined vs Separate](https://developer.community.nhs.uk/t/combined-vs-separate/11568)
**Author:** [@steve.borman](https://developer.community.nhs.uk/u/steve.borman)\ **Replies:** 4\ **Last updated:** [9 April 2026 12:58 UTC](https://developer.community.nhs.uk/t/combined-vs-separate/11568 "2026-04-09T12:58:09Z")
I am reading through the documentation on both the Combined Auth and Separate Auth options. I understand there is an onboarding requirement for separate but I am also finding a few differences that the documentation doe… --- ## ['Invalid parameter: redirect\_uri' when trying to use the intergration mock cis2 login](https://developer.community.nhs.uk/t/invalid-parameter-redirect-uri-when-trying-to-use-the-intergration-mock-cis2-login/7218)
**Author:** [@George\_Paddon](https://developer.community.nhs.uk/u/George_Paddon)\ **Replies:** 6\ **Last updated:** [31 March 2026 13:27 UTC](https://developer.community.nhs.uk/t/invalid-parameter-redirect-uri-when-trying-to-use-the-intergration-mock-cis2-login/7218 "2026-03-31T13:27:40Z")
We have the regular intergration cis2 working for our application and I’m trying to setup the mock cis2 intergration for our tests. I’m running into an issue while trying to use the ‘https://identity.ptl.api.platform.nh… --- ## [Mock authorisation service for NHS CIS2 - invalid redirect\_uri](https://developer.community.nhs.uk/t/mock-authorisation-service-for-nhs-cis2-invalid-redirect-uri/11135)
**Author:** [@tc1](https://developer.community.nhs.uk/u/tc1)\ **Replies:** 1\ **Last updated:** [31 March 2026 13:26 UTC](https://developer.community.nhs.uk/t/mock-authorisation-service-for-nhs-cis2-invalid-redirect-uri/11135 "2026-03-31T13:26:49Z")
I’m trying to follow https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/testing-with-our-mock-authorisation-service-using-nhs-cis2---separate-authentication#2-using-our-mock-identity-pro… --- ## [Localhost:43487 login dialog](https://developer.community.nhs.uk/t/localhost-43487-login-dialog/11121)
**Author:** [@helloworld](https://developer.community.nhs.uk/u/helloworld)\ **Replies:** 4\ **Last updated:** [30 March 2026 07:59 UTC](https://developer.community.nhs.uk/t/localhost-43487-login-dialog/11121 "2026-03-30T07:59:27Z")
hello, have been working with the CIS2 API in INT for a few weeks now, however have just today had the following error, CIS2 login flow redirects the browser to the “select your login method” screen as usual but upon se… --- ## [Missing selected\_roleid in response on INT](https://developer.community.nhs.uk/t/missing-selected-roleid-in-response-on-int/10760)
**Author:** [@Felix\_Michaux](https://developer.community.nhs.uk/u/Felix_Michaux)\ **Replies:** 14\ **Last updated:** [27 February 2026 11:46 UTC](https://developer.community.nhs.uk/t/missing-selected-roleid-in-response-on-int/10760 "2026-02-27T11:46:26Z")
On a few occasions we’ve run into issues logging in to our application via CIS2 on INT as the selected\_roleid item is missing from the ID token claim. Our logs show instances of this happening just now, as well as at th… --- ## [Care Identity email domain allow list](https://developer.community.nhs.uk/t/care-identity-email-domain-allow-list/1397)
**Author:** [@Stephen.Rogers](https://developer.community.nhs.uk/u/Stephen.Rogers)\ **Replies:** 2\ **Last updated:** [16 February 2026 15:06 UTC](https://developer.community.nhs.uk/t/care-identity-email-domain-allow-list/1397 "2026-02-16T15:06:09Z")
Hello, I’m wanting to find out if the allowed domains list displayed here is available via an api Care Identity email domain allow list - NHS England Digital Thanks Stephen --- ## [Identity Provider on top of CIS2](https://developer.community.nhs.uk/t/identity-provider-on-top-of-cis2/820)
**Author:** [@codur.pranam](https://developer.community.nhs.uk/u/codur.pranam)\ **Replies:** 7\ **Last updated:** [2 January 2026 09:46 UTC](https://developer.community.nhs.uk/t/identity-provider-on-top-of-cis2/820 "2026-01-02T09:46:57Z")
Hello, Greetings. I work at Okta. A customer of ours uses CIS2 to access the Spine. They want to explore the possibility of Okta being the Identity provider to CIS2. I know CIS2 is built on top of ForgeRock so technica… --- ## [NHS Professional API question](https://developer.community.nhs.uk/t/nhs-professional-api-question/9367)
**Author:** [@Jacob\_Prime](https://developer.community.nhs.uk/u/Jacob_Prime)\ **Replies:** 3\ **Last updated:** [15 December 2025 12:36 UTC](https://developer.community.nhs.uk/t/nhs-professional-api-question/9367 "2025-12-15T12:36:21Z")
Hi there - we are working an NHS trust to try and help automate their access request process for members of staff coming from NHS Professionals, that are covering shifts. Does anyone know if the NHS P platform has APIs t… --- ## [User-restricted NHS CIS2 separate authentication and authorisation - Java tutorial](https://developer.community.nhs.uk/t/user-restricted-nhs-cis2-separate-authentication-and-authorisation-java-tutorial/9174)
**Author:** [@Dewald\_Mienie](https://developer.community.nhs.uk/u/Dewald_Mienie)\ **Replies:** 2\ **Last updated:** [3 December 2025 10:31 UTC](https://developer.community.nhs.uk/t/user-restricted-nhs-cis2-separate-authentication-and-authorisation-java-tutorial/9174 "2025-12-03T10:31:56Z")
Good day, I am busy with the User-restricted NHS CIS2 separate authentication and authorisation - Java tutorial. I’ve registered an application and configured the environment variables as specified. Below is a screensh… --- ## [CIS2 authentication for PDS](https://developer.community.nhs.uk/t/cis2-authentication-for-pds/9054)
**Author:** [@Tim\_Morgan](https://developer.community.nhs.uk/u/Tim_Morgan)\ **Replies:** 2\ **Last updated:** [28 November 2025 09:05 UTC](https://developer.community.nhs.uk/t/cis2-authentication-for-pds/9054 "2025-11-28T09:05:03Z")
Please can you confirm what CIS2 authentication methods are suitable for PDS access in our use-case? We require CIS2 authentication, to allow for patient details / deceased check via PDS, within our process for e-RS (th… [Next page](https://developer.community.nhs.uk/c/cis/22.md?page=1)