Does the Coronavirus in the UK website have an API for developers?

No, the Coronavirus in the UK website (gov.uk/coronavirus) is a public information portal and does not offer an API or direct developer integration for programmatic access to its content.

How do I authenticate to access general Coronavirus in the UK information?

You do not need to authenticate to access general public health information on the Coronavirus in the UK website. It is openly accessible to all users.

What authentication methods are used for personalized services linked from the Coronavirus in the UK website?

Personalized services linked from the Coronavirus in the UK website, such as managing a COVID Pass or booking tests, typically use GOV.UK One Login or NHS login for user authentication.

How do I get credentials for GOV.UK One Login or NHS login?

You can create an account and verify your identity directly through the GOV.UK One Login or NHS login portals. This usually involves providing an email, setting a password, and verifying your identity using official documents or knowledge-based questions.

Is multi-factor authentication (MFA) required for government services related to Coronavirus in the UK?

MFA is strongly recommended and often required for higher assurance personalized government services accessed via GOV.UK One Login or NHS login to enhance account security.

Can I use social media accounts to log in to government services?

No, UK government digital identity services like GOV.UK One Login and NHS login do not support authentication via social media accounts. They use dedicated government-managed identity verification processes.

What should I do if I suspect my GOV.UK One Login or NHS login credentials have been compromised?

If you suspect a compromise, immediately change your password for the affected service and enable multi-factor authentication if not already active. Report the incident through the official channels provided by GOV.UK or NHS.

Coronavirus in the UK Authentication: Accessing Official Guidance

Authentication overview

The UK government's official Coronavirus in the UK website (gov.uk/coronavirus) serves as a central hub for public health information, guidance, and updates related to the COVID-19 pandemic. Unlike commercial API providers such as Stripe's API documentation or Google Maps Platform APIs, this platform is not designed for direct developer integration via an API. Consequently, there are no specific API keys, OAuth flows, or SDKs provided for programmatic access to its content.

Authentication, in the context of the Coronavirus in the UK website, primarily refers to the methods by which individuals verify their identity to access personalized government services that might be related to COVID-19, such as applying for support, accessing health records, or managing vaccination appointments. These services typically integrate with broader UK government digital identity systems rather than having a standalone Coronavirus-specific authentication mechanism. The primary method for accessing general public information on the gov.uk website does not require any authentication.

The UK government has been transitioning its digital identity services. Historically, GOV.UK Verify was the system used for verifying identity across various government services. As of 2026, the focus has shifted towards GOV.UK One Login, which aims to provide a single, secure account for accessing all government online services. This unified approach simplifies the user experience and enhances security across different departmental portals.

Supported authentication methods

Since the Coronavirus in the UK website is a public information portal, direct authentication for accessing its core content is not required. However, when users need to interact with specific government services linked from the Coronavirus pages—such as booking a test, accessing a COVID Pass, or applying for financial support—they will be directed to services that utilize established UK government digital identity authentication methods. The table below outlines the general authentication approaches used by linked government services.

Method	When to Use	Security Level
No Authentication	Accessing general public health information on gov.uk/coronavirus.	N/A (public access)
GOV.UK One Login	Accessing personalized government services (e.g., managing a COVID Pass, accessing health records, applying for benefits related to COVID-19).	High (multi-factor authentication supported)
NHS login	Accessing NHS-specific services (e.g., booking vaccination appointments, viewing health information via the NHS App).	High (multi-factor authentication supported)
Third-party identity providers (e.g., bank ID)	Historically used by GOV.UK Verify; less common with GOV.UK One Login's direct approach. May still be an option for some legacy services.	Varies by provider, generally High

GOV.UK One Login is designed to be a secure and user-friendly system, enabling individuals to prove their identity once and use that verified identity across numerous government services. This system supports various identity verification methods, including document checks and facial recognition, to ensure a robust level of assurance for sensitive transactions.

Getting your credentials

For accessing the public information on the Coronavirus in the UK website, no credentials are required. It is openly accessible to all users with internet access.

For services that require authentication via GOV.UK One Login, individuals must register for an account. The process typically involves:

Creating an account: Providing an email address and creating a password.
Verifying identity: This can involve various methods, such as:

Using a UK passport or driving licence to verify identity digitally.
Answering questions based on credit history (knowledge-based authentication).
Receiving a code via post to a registered address.

Setting up multi-factor authentication (MFA): This is strongly recommended and often required for higher assurance services. MFA can involve a code sent to a mobile phone, an authenticator app, or a physical security key. The GOV.UK One Login program emphasizes strong security measures, including MFA, to protect user accounts.

For NHS-specific services, users typically register for an NHS login. This process is similar to GOV.UK One Login, often requiring identity verification through a passport or driving licence, and linking to an NHS record. Once an NHS login is established, it can be used to access services like the NHS App, which may contain COVID-19 related information or services.

Authenticated request example

As the Coronavirus in the UK website does not offer a public API for programmatic access, there are no code-based authenticated request examples to provide. The primary interaction model is a user navigating a web browser to the official government website. When an authenticated action is required, the user interface will guide the individual through the GOV.UK One Login or NHS login process.

For example, if a user wants to view their digital COVID Pass, they would typically:

Navigate to the relevant section on gov.uk or within the NHS App.
Be prompted to log in using their GOV.UK One Login or NHS login credentials.
Enter their username (email address) and password.
Complete the multi-factor authentication step (e.g., enter a code from an authenticator app or SMS).
Upon successful authentication, they would gain access to their personalized COVID Pass information.

This process is entirely user-driven through a graphical interface, adhering to standard web application security practices, including HTTPS for encrypted communication. The underlying authentication protocols used by GOV.UK One Login and NHS login, such as OAuth 2.0 and OpenID Connect, operate behind the scenes to secure the user's session once authenticated.

Security best practices

When interacting with any government digital service, including those linked from the Coronavirus in the UK website, adhering to security best practices is crucial to protect personal information and prevent unauthorized access. The UK government's Digital Service (GDS) provides comprehensive security guidance for government services, which informs the design and operation of its authentication systems.

Key security best practices for users include:

Use Strong, Unique Passwords: Create complex passwords that are difficult to guess and do not reuse them across different services. Password managers can assist in generating and storing these securely.
Enable Multi-Factor Authentication (MFA): Always activate MFA where available (e.g., GOV.UK One Login, NHS login). This adds an essential layer of security, requiring a second verification step beyond just a password.
Be Wary of Phishing Attempts: Government services will typically not ask for personal credentials via unsolicited emails or text messages. Always verify the sender and the URL before clicking links or entering information. Official government websites use a 'gov.uk' domain.
Keep Software Updated: Ensure your operating system, web browser, and security software (antivirus) are kept up-to-date to protect against known vulnerabilities.
Use Secure Networks: Avoid accessing sensitive government services over unsecured public Wi-Fi networks. Use a trusted private network or a Virtual Private Network (VPN) for enhanced security.
Log Out After Use: Always explicitly log out of government services, especially when using a shared or public computer, to terminate your session and prevent others from accessing your account.
Monitor Account Activity: Regularly review any account activity notifications or logs provided by the service to detect and report any suspicious access or changes.

By following these guidelines, users can significantly reduce the risk of unauthorized access to their personal data and maintain the integrity of their interactions with official UK government digital services related to Coronavirus in the UK and beyond.