Build a working sign-in, then test its edges.
Start with a signed token from your own test provider. Then connect the app you’re building.
Getting started
Signup, confirmation and a starter client you can test immediately.
ASP.NET Core, browser SPAs and Node.js examples.
Start from an existing token
Review a token and build a test configuration
An optional scratchpad, or a new configuration in a tenant you own.
Testing guides
Test Microsoft.Identity.Web and MSAL apps without an Entra ID tenant
Run your ASP.NET Core web app, web API or MSAL client against Entra-shaped endpoints with test users and roles.
A fake OIDC provider for Playwright and CI end-to-end tests
Sign in as different test users in browser tests, with real tokens and no flaky third-party login pages.
Test role-based authorization with configurable test users
Give test users different roles and verify your access control in ASP.NET Core and SPAs.
Test failed sign-ins: denied users, silent sign-in and revoked refresh tokens
Make a test user deny access, be unavailable, fail silent sign-in or lose refresh, and check how your app reacts (Pro).
Test signing key rotation: JWKS caching and unknown kid (Pro)
Generate a new key for one configuration, keep the previous key briefly or revoke every earlier key, and check your app's JWKS refresh.
Reference and account access
- Session pinning and the live walkthrough
- Usage limits, request accounting and CI guidance
- Sign in with email to reach your tenants
- Account access and claim codes
- Agent API and MCP guide
Use fictional people and development credentials. HeyIdentity is for development and testing only.