Create a production configuration for your service

Before you can integrate with the GOV.UK One Login production environment, you must create a production configuration for your service.

The Service Level Agreement (SLA) for creating your GOV.UK One Login production configuration is 10 working days.

You must request your production service be set up at least 10 days before you want to start using it in private or public beta. You should give yourself enough time to check your integration with GOV.UK One Login before your go-live date.

You must connect to the GOV.UK One Login production environment only from your own service’s production environment.

Before you start

Before you configure your service for production, you’ll need to have worked with your Engagement Manager to complete the governance for your service. For example, you’ll need to have signed your Memorandum of Understanding (MOU), considered fraud and security, and set up analytics.

If you do not have an Engagement Manager, complete the form to register your interest for one. You’ll need to complete this form a minimum of 6 weeks before your go-live date.

Set up a production configuration

Any changes made to integration configurations will not apply to your production configuration.

You can continue to use your configurations in integration independent of the production configuration.

You cannot use the GOV.UK One Login Admin Tool to configure a production configuration.

To set up your production configuration:

Send your Engagement Manager and Technical Architect:
- the ClientID of your tested integration configuration
- 2 or more email addresses of technical contacts from your team who will be responsible for providing the production configuration values
The GOV.UK One Login team will email a JSON draft production configuration to the contacts you provided. The draft configuration will be based on the configuration for the integration ClientID you provided in step 1, and will contain the production ClientID your service should use. If you’re using client_secret_post, the GOV.UK One Login team will also ask you to create a production secret and send the hashed version of the secret to GOV.UK One Login. There’s further guidance on integrating third-party platforms with GOV.UK One Login.
Your technical contacts must replace the JSON production configuration attribute placeholders with your production environment-specific values.
Your technical contacts must respond to the email containing the draft configuration with the updated JSON draft production configuration back.
The GOV.UK One Login team reviews the supplied configuration and will request clarification if needed.
The GOV.UK One Login team creates a production configuration based on the agreed JSON. This may take a number of days.
The GOV.UK One Login team emails your technical contacts when we have created your production configuration and you can test your service. The email will reconfirm the ClientID for the production configuration provided in step 2.
You must make sure that your production configuration:
- uses the new production ClientID
- use the production discovery endpoint, viewed at production discovery endpoint, to determine the GOV.UK One Login production endpoints
- uses your production private RSA key, if you’re using private_key_jwt
- uses your production client secret, if you’re using client_secret_post
Test your production configuration to check that it can access GOV.UK One Login services before you go live.
You’re now ready for your users to start using GOV.UK One Login. You must let your Engagement Manager know when it’s live and you have users using your service.

Making changes after your service is live

After your production configuration is live, you must request any changes to your production configuration through the Live Service Hub.

Replace placeholder attributes in the JSON production configuration

This is guidance to help you replace the placeholder JSON attributes in the production configuration. The values will vary depending on how your service interacts with GOV.UK One Login. You must not change any values other than the placeholders in the provided JSON.

Placeholder name	JSON attribute	Required or Optional	Description
{BACKCHANNEL_LOGOUT_URI}	`BackChannelLogoutUri`	Required if you need logout notifications. You’ll be asked for this if you configured a `BackChannelLogoutUri` in the integration client.	Your endpoint where you want to receive back channel logout notifications.
{CLIENT_NAME}	`ClientName`	Required	The human-readable name of your production configuration. This is used to inform the user which service they are returning to when they are redirected back to the service following a successful identity journey.
{JWKS_URL}	`JwksUrl`	Required if the `PublicKeySource` attribute is set to `JWKS`	The JWKS endpoint where GOV.UK One Login can access the public keys used to verify signed JWTs sent in the `/authorize` request and/or the `/token` request .
{LANDINGPAGE_URL}	`LandingPageUrl`	Strongly recommended if your service can request identity, for example if the `IdentityVerificationSupported` attribute is set to `true`. You’ll be asked for this if you configured a `LandingPageUrl` in the integration client	The URL GOV.UK One Login will redirect your user to on completion of a face-to-face identity check.
{POSTLOGOUT_REDIRECT_URLS}	`PostLogoutRedirectUrls`	Strongly recommended if you are offering your user the ability to logout from GOV.UK One Login You’ll be asked for this if you configured `PostLogoutRedirectUrls` in the integration client	There’s further guidance on logging your user out.
{PROVIDE_SEPARATELY}	`ClientSecret`	Required if you’re using `client_secret_post` as your token authentication method.	You must leave the {PROVIDE SEPARATELY} placeholder in place and provide the client secret in a separate email.
{PUBLIC_KEY}	`PublicKey`	Required if the `PublicKeySource` attribute is set to `STATIC`	A public key you can use to verify signed JWTs sent in the `/authorize` request and/or the `/token request`.
{REDIRECT_URLS}	`RedirectUrls`	Required	The list of `redirect_url` values your service will be sending in production.
{SECTORIDENTIFIER_URI}	`SectorIdentifierUri`	Required	There’s further guidance on using sector identifiers.

Examples of JSON production configuration with placeholders

Authentication-only using `private_key_jwt`

{
"ClientID": "2nhgqtHQtJn9pVnJ74V1wY7Llo0",
"Channel": "WEB",
"ClientLoCs": [
   "P0"
],
"ClientName": "{CLIENT_NAME}",
"ClientType": "web",
"CookieConsentShared": false,
"IdentityVerificationSupported": false,
"IdTokenSigningAlgorithm": "RS256",
"IsActive": true,
"JarValidationRequired": true,
"MaxAgeEnabled": false,
"OneLoginService": false,
"PermitMissingNonce": false,
"PKCEEnforced": false,
"PostLogoutRedirectUrls": [
   "{POSTLOGOUT_REDIRECT_URLS}"
],
"PublicKey": "{PUBLIC_KEY}",
"PublicKeySource": "STATIC",
"RedirectUrls": [
   "{REDIRECT_URLS}"
],
"Scopes": [
   "openid",
   "email",
   "phone"
],
"SectorIdentifierUri": "{SECTOR_IDENTIFIER_URL}",
"ServiceType": "MANDATORY",
"SmokeTest": false,
"SubjectType": "pairwise",
"TestClient": false,
"TestClientEmailAllowlist": [
],
"TokenAuthMethod": "private_key_jwt"
}

Authentication and identity using `private_key_jwt`

{
 "ClientID": "JIS7mbqOcs8auNqL4v33aZqEKBs",
 "BackChannelLogoutUri": "{BACKCHANNEL_LOGOUT_URL}",
 "Channel": "WEB",
 "Claims": [
    "{CLAIMS}"
 ],
 "ClientLoCs": [
    "P2"
 ],
 "ClientName": "{CLIENT_NAME}",
 "ClientType": "web",
 "CookieConsentShared": false,
 "IdentityVerificationSupported": true,
 "IdTokenSigningAlgorithm": "RS256",
 "IsActive": true,
 "JarValidationRequired": false,
 "JwksUrl": "{JWKS_URL}",
 "LandingPageUrl": "{LANDING_PAGEURL}",
 "MaxAgeEnabled": false,
 "OneLoginService": false,
 "PermitMissingNonce": false,
 "PKCEEnforced": false,
 "PostLogoutRedirectUrls": [
    "{POSTLOGOUT_REDIRECT_URLS}"
 ],
 "PublicKeySource": "JWKS",
 "RedirectUrls": [
    "{REDIRECT_URLS}"
 ],
 "Scopes": [
    "openid",
    "email",
    "phone"
 ],
 "SectorIdentifierUri": "{SECTORIDENTIFIER_URI}",
 "ServiceType": "MANDATORY",
 "SmokeTest": false,
 "SubjectType": "pairwise",
 "TestClient": false,
 "TestClientEmailAllowlist": [
 ],
 "TokenAuthMethod": "private_key_jwt"
}

Authentication and identity using `client_secret_post`

In this example the ClientID would be the production client-id for GOV.UK One Login. Also, you must provide the ClientSecret separately using the mailbox. There’s further guidance on integrating third-party platforms with GOV.UK One Login.

{
"ClientID": "H69dApWzYRzVOQPHVl8ZJgfCfe0",      
"Channel": "WEB",
"ClientLoCs": [
   "P0"
],
"ClientName": "CLIENT_NAME}",
"ClientSecret": "{PROVIDED SEPARATELY}",                        
"ClientType": "web",
"CookieConsentShared": false,
"IdentityVerificationSupported": false,
"IdTokenSigningAlgorithm": "ES256",
"IsActive": true,
"JarValidationRequired": false,
"MaxAgeEnabled": false,
"OneLoginService": false,
"PermitMissingNonce": false,
"PKCEEnforced": false,
"PostLogoutRedirectUrls": [
   "{POSTLOGOUT_REDIRECT_URLS}"
],
"PublicKeySource": "STATIC",
"RedirectUrls": [
   "{REDIRECT_URLS}"
],
"Scopes": [
   "openid",
   "email",
   "phone"
],
"SectorIdentifierUri": "{SECTORIDENTIFIER_URI}",
"ServiceType": "MANDATORY",
"SmokeTest": false,
"SubjectType": "pairwise",
"TestClient": false,
"TestClientEmailAllowlist": [
],
"TokenAuthMethod": "client_secret_post"
}

This page was last reviewed on 17 August 2026.

Cookies on GOV.UK Sign In