Before you can integrate with Mosaic, you'll need to create an application. The application is the container for shared configuration across your integration, including branding, authentication settings, and more. After the application is created, open its details page and add one or more clients—each client represents a specific implementation and carries its own settings.
As a best practice, use one client per integration. For example, use a web client for your browser app, one native client for your Android app, and a separate native client for your iOS app.
Let's assume you are integrating a food delivery service with Mosaic, and you have created an application for it. The service has a web version as well as a native iOS app. The web app and mobile app would typically be configured as separate clients under the same application.
Certain settings are configured on the application level and are shared across clients. These include general details, branding, authentication methods, and other app-wide settings. Clients also share the same user space within the application—for example, if a new user signs up using a web app, they no longer need to register again in the mobile app because they already belong to that application.
The settings specific to a client include, for example, credentials used for generating client access tokens, client type, redirect configuration, resources, and enabled flows. For example, you can configure one client for browser-based login and another for a backend-only integration.
During client creation, Mosaic streamlines setup into these main client paths:
- User authentication clients, which cover end-user authentication, supported platform services, and backend-based authentication tied to your application
- Service clients, which cover API-only backend-to-backend use cases such as Fraud Prevention (
DRS), Identity Verification (IDV), and generic machine-to-machine (M2M) integrations that do not rely on an end-user authentication flow
The distinction between User authentication client and Service client is used only during client creation to guide you through the right setup path. After the client is created, you manage it from the client’s settings tabs, where the available configuration depends on that client’s type and setup.
Within the User authentication client path, you can create OIDC or SAML clients, or continue with backend-based authentication when OIDC/SAML authentication is turned off. OIDC is the default option for most Mosaic integrations, while SAML is limited to SSO Service and Hosted login. See Manage clients.
By default, app clients are first-party clients, meaning they are owned by you. For OIDC clients, you can optionally configure a third-party client to represent an external service that requests access to your app resources on the user's behalf. This requires user consent. For details, see Manage clients.
For supported client types, you can assign client roles to limit what a client can do in Mosaic APIs. Client roles can be assigned to OIDC clients and service clients, but not to SAML clients or third-party OIDC clients. See Manage client roles.
- Create and configure OIDC, SAML, backend-based, and service clients from the application details page: Manage clients.
- Review the shared settings that apply across clients in the same application, such as branding, authentication methods, resources, and app-level roles: Manage applications