# Authentication problem with PDS app

**URL:** <https://developer.community.nhs.uk/t/authentication-problem-with-pds-app/747>\
**Category:** Personal Demographics Service (PDS)\
**Tags:** testing, pds, spine\
**Created:** [20 February 2024 11:31 UTC](https://developer.community.nhs.uk/t/authentication-problem-with-pds-app/747 "2024-02-20T11:31:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![glenn.hutchings](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@glenn.hutchings](https://developer.community.nhs.uk/u/glenn.hutchings)\
**Post date:** [20 February 2024 11:31 UTC](https://developer.community.nhs.uk/t/authentication-problem-with-pds-app/747/1 "2024-02-20T11:31:15Z")

</div>

Hi there.

I have an app which uses the Personal Demographics Service as follows:

- App ID is `3a48b0c6-0735-4535-b164-01f143025118`
- Application-Restricted (Integration Testing) API is connected
- Public/private keys generated as per the instructions [here](https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/application-restricted-restful-apis-signed-jwt-authentication#step-2-generate-a-key-pair)
- Public key hosted by the NHS

But when I try to authenticate, I get a 401 error:

```
Invalid 'kid' header in client_assertion JWT - no matching public key

```

I’ve checked that the KID is correct, the JWT is valid and the public/private keys are verified (both checked using [https://jwt.io](https://jwt.io)). Any idea what the problem might be?

Glenn

---

<div class="post-metadata">

**Author:** ![damon.mcp](https://dub1.discourse-cdn.com/nhsdigitaldeveloper/user_avatar/developer.community.nhs.uk/damon.mcp/32/265_2.png) [@damon.mcp](https://developer.community.nhs.uk/u/damon.mcp)\
**Post date:** [21 February 2024 00:32 UTC](https://developer.community.nhs.uk/t/authentication-problem-with-pds-app/747/2 "2024-02-21T00:32:25Z")

</div>

Glen,

Have you added the public key url and uploaded a json format of public key to the application?

Also can you confirm the key pair was generated as RS512 algorithm.

Regards

Damon

---

<div class="post-metadata">

**Author:** ![glenn.hutchings](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@glenn.hutchings](https://developer.community.nhs.uk/u/glenn.hutchings)\
**Post date:** [21 February 2024 09:18 UTC](https://developer.community.nhs.uk/t/authentication-problem-with-pds-app/747/3 "2024-02-21T09:18:21Z")

</div>

Hi Damon. Yes to all these:

- Public/private keys were generated using `openssl` according to the instructions I linked to above, which (I assume) use RS512

- Public key is uploaded to the ‘Public key URL’ part of the Security Details, and can be seen [here](https://api.service.nhs.uk/mock-jwks/ewogICJrZXlzIjogWwogICAgewogICAgICAia3R5IjogIlJTQSIsCiAgICAgICJuIjogInNUVno1M3hseFlsb2trTmhMaUU3QnFKakFzQzA5Q0taUEpTWG14SmFnY3U2RWxuQ0kxQ0VvUERsQ25WZG9vWDhadVFNVHl1V2ZnbTVNbWlLVnoxUmtfVVNUZ2JtNjd1bHdBaXR3MFl1UHMtaXo2aTlSUWgzTjExa1RRajM0TmZvdFdJODBmQmduRmJpcXlEQ0w3aHUzRGNsQnF0QnJ2d0NiYWprY1NLbFU2cmRHOHBoSkptWDRSZXlkZ0lUWDllbVdJUjl3cW5QLWZSX3dObVlkWUpTUy01cVRUWjE2RnVadG9WNDhUQ1RUdkVaa1ZEd0NSWlFaUGhCUWxaTXhfMG1pbzYzM1Z4U1paS3dJZHNkRjhWaERaODBvVXp5MFgtZVcwSGtGdU9xTzFQLVNVYkd5Tm1zc1ZoT01xeTJ3WkszejZZaFhHQmg5bXFOTjFTbFVwbm9LbWZxdm45eTQ3ZXIzSWNSRDNWb1RGWEsxb3JiUjIyYXd0aF8wamx6Mm9RTElpYU5PWjNIWjdraDROZ2lXcmFOSmFiOTloZk1TWmpwcDdEYWNYbW5TQUpXWUdET1pTNm50VEVBeVlocDNlTHAydWx0N3kxb2NNNllfWl8yYTZGRjVWbDVkTE9qY2pYZmhhVllJaVVyWUI4LXYycDVlTFp3Rl9WdE5qX2tWc095N3BaZ2ZMMjZXS1EtVWJ5aFhCMk5ZOG44bkhoSENjMVV3YXFOMlJsU1pVSm41cFFGYzBqNVBzX0VpNk1HS2c1QXhOeGpXV1AwTmxoekp0RTU3ZUd4d25Ga2s5TndYR0VJMlUyYnU3alFaN3l3NENidVVsLVFEVEhxckNCNUwyVE10LWtqcWVEZ08takw3a0ZCd0ptVjRNRzNpNEFZdThubTBiaWlrZ0RWYVZFIiwKICAgICAgImUiOiAiQVFBQiIsCiAgICAgICJhbGciOiAiUlM1MTIiLAogICAgICAia2lkIjogImh0b2RlbW9nLXRlc3QtMSIsCiAgICAgICJ1c2UiOiAic2lnIgogICAgfQogIF0KfQo)

Glenn

---

<div class="post-metadata">

**Author:** ![glenn.hutchings](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@glenn.hutchings](https://developer.community.nhs.uk/u/glenn.hutchings)\
**Post date:** [23 February 2024 11:06 UTC](https://developer.community.nhs.uk/t/authentication-problem-with-pds-app/747/4 "2024-02-23T11:06:59Z")

</div>

Problem is resolved. It turns out there was a subtle error in my setup (tiny typo in the KID name used for local testing). I thought there must be somewhere, but just missed it.