Test your app's sign-in without a real identity provider.

Features

Integration

Every configuration has its own issuer. Use the discovery URL with any standards-compliant OIDC library.

# Discovery (Generic and Microsoft profiles)
https://app.heyidentity.dev/t/{tenantRouteId}/c/{configurationId}/.well-known/openid-configuration

# Entra ID authority (Microsoft profile): Instance = https://app.heyidentity.dev/, TenantId = {configurationId}
https://app.heyidentity.dev/{configurationId}/v2.0

ASP.NET Core

builder.Services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie()
.AddOpenIdConnect(options =>
{
    options.Authority = "https://app.heyidentity.dev/t/{tenantRouteId}/c/{configurationId}";
    options.ClientId = "my-app";
    options.ClientSecret = "my-app-secret";
    options.ResponseType = "code";
    options.Scope.Add("email");
    options.MapInboundClaims = false;                     // keep "roles" and "name" as issued
    options.TokenValidationParameters.NameClaimType = "name";
    options.TokenValidationParameters.RoleClaimType = "roles";
});

Browser SPA (oidc-client-ts)

import { UserManager } from 'oidc-client-ts';

const userManager = new UserManager({
  authority: 'https://app.heyidentity.dev/t/{tenantRouteId}/c/{configurationId}',
  client_id: 'my-spa',                      // public client: PKCE, no secret
  redirect_uri: `${location.origin}/callback`,
  scope: 'openid profile email',
});
await userManager.signinRedirect();

Node.js (openid-client)

import * as client from 'openid-client';

const config = await client.discovery(
  new URL('https://app.heyidentity.dev/t/{tenantRouteId}/c/{configurationId}'),
  'my-app',
  'my-app-secret',
);
const verifier = client.randomPKCECodeVerifier();
const url = client.buildAuthorizationUrl(config, {
  redirect_uri: 'http://localhost:3000/callback',
  scope: 'openid profile email',
  code_challenge: await client.calculatePKCECodeChallenge(verifier),
  code_challenge_method: 'S256',
});

Your tenant route ID and configuration ID are shown on your management page after signup. The live demo uses public demo configurations you can try right away.

Step-by-step: Entra ID apps without a tenant, Playwright and CI tests, role-based authorization.

Pricing

HeyIdentity is in beta. Free covers test suites that reuse signed-in state. Pro raises the limits, so a suite can sign in once per test class, and adds session pinning. Early adopters get it free. Enterprise raises a tenant's total for suites on several runners, granted on request.

Full limits, including how to tell a rejected request apart.