Skip to main content

Test staff sign-in with Staff Identity

Staff Identity is the simulator's CIS2-style staff identity service. Its staff identities, organisations, and roles are fictional. A staff token does not replace the team API key or grant access to a team world.

Try a staff sign-in​

  1. Open Staff Identity and choose the simulated smartcard or security-key method.
  2. Start sign-in and choose a fictional staff identity.
  3. Select an organisation and role, then continue.
  4. Inspect the identity on the result page. Expand Technical session details for the returned identity and expiry information.

No hardware, smartcard PIN, or NHS password is required. Cancelling sign-in returns a denial instead of creating a staff session.

Connect your application​

Discover the issuer through the OpenID discovery document. The implemented flow uses authorization code with PKCE S256 and RS256-signed identity tokens. The bundled nhs-sim-client uses this origin's /cis2/callback route.

An organiser can register your client ID and exact redirect URLs. Start a fresh authorization request with your own state, nonce, and PKCE challenge. Exchange the one-time code using its verifier, then call the discovered userinfo endpoint with the staff access token. Use the discovery document's JWKS URL to verify identity-token signatures.

The API reference, API explorer, and OpenAPI JSON describe the simulator's endpoints. The browser sign-in demonstrates the interactive consent and role-selection flow.

Exercise failure cases​

In Developer and operator tools, enter the organiser token and choose Unlock operator controls. Select normal sign-in, consent denied, service unavailable, or session expired. Set a token lifetime between 30 and 3,600 seconds, or edit the registered applications.

Apply settings revokes existing interactions, codes, and access tokens. Revoke all sessions invalidates them without changing the scenario. These settings affect the running application, not a single team world. Restore normal sign-in after the exercise. Restarting the application resets identity settings and sessions.