NHS Login Authentication

API Platform
1

I’m looking to run a test where I click a link and get redirected to the nhs login page, authenticate and then get the token back.

I think from instructions it tells me to enable nhs login in the developer portal but I’m not seeing this.

I have added an application, added the hello world, can’t see any enable nhs login option

Any help would be appreciated

2

Hi Craig,

Thank you for your patience with this query.

What you are seeing is expected behaviour, and it usually causes confusion early on for first time users of NHS Login. It is important to note that NHS login is only applicable to user-restricted APIs (that is, APIs where a real end user/patient or clinician must authenticate).

If your application is:

  • Using open access APIs, or
  • Using application-restricted APIs (client credentials / signed JWT),

then NHS login will not appear as an option in the Developer Portal for that application. The “Hello World” examples you have added fall into this category.

For early development and automated testing, you should use the NHS Login mock service, not the real NHS Login service.

The mock service:

  • Simulates the NHS Login OIDC flow
  • Runs in the API Platform integration (INT) environment
  • Lets you test redirects, callbacks, and token exchange

Follow the guidance here ( https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/testing-with-our-mock-authorisation-service-using-nhs-login---separate-authentication) if you haven’t already used it:

  • You must use a callback URL that is explicitly registered against your application
  • The mock validates redirect_uri strictly
  • Common practice is to use a stable HTTPS URL (for example https://google.com) for early testing if you don’t yet have a hosted callback endpoint.

Hope the above helps.

You can always ask further questions on NHS Login through their dedicated area on this community: (NHS Login - NHS England Developer Community)

Thanks,

NHS England API Platform team

Please note: The API Platform team can only address queries relevant to the NHS England API platform, including security, rate limiting, logging, monitoring and alerting. For any API, CIS2, NHS Login specific queries, please reach out the relevant API / Service teams.