This page is the detail for Setup overview — Step 1: Configure B2B.
Configure the B2B application settings to activate the invite flow, expose the Organization admin portal to org admins, and define how refresh tokens are invalidated based on member events.
If you don't have an application yet, in the Admin Portal, open Applications >create an app before proceeding.
To create the client:
- In the Admin Portal, open Applications > your app > Clients tab.
- Click + Add client and set PKCE to disabled. Only clients with PKCE disabled can be used for inviting members.
- Note the client name — you will select it in Configure the invite flow below.
In Admin Portal, go to Applications > your app > B2B settings tab.
Configure the addresses for redirecting users after completing the invite flow.
Application URI for inviting members
The URL in your app where users are redirected when they accept a membership invite — for example,https://your-app.example.com/login. The URL must be reachable by the invited user.Client for inviting members
Select the client you created in Step 1 of this guide, or add a dedicated one.
If you configure a B2B invite journey in SSO and Federation > Configuration tab > B2B configuration box, the journey is only invoked when the member belongs to an organization that is associated with the IDO SSO service app. Make sure the target organization is linked to that application before sending invitations.
- Member invite link expiration in minutes Set how long invite links remain valid after they are sent. Adjust to match your onboarding policy.
- Accepted range: 5–10080 minutes (up to 7 days).
- Default: 2880 minutes (48 hours).
Configure the URL to reach the Org admin portal:
Org admin portal domain
A subdomain prefix for the Org admin portal. The full URL will be:
<your-subdomain>.org.<environment-suffix>For example,
yourcompany.org.sbx.transmitsecurity.io. Each application must use a unique subdomain.
These toggles control whether a member's refresh tokens are invalidated when specific events occur. Enabling them forces re-authentication the next time the client tries to renew an access token.
Member suspension
Trigger: A member is suspended from an organization.
Recommendation: Enable — suspended members should not retain active sessions.Member password reset
Trigger: A member resets their password.
Recommendation: Enable — ensures sessions end after a credential change.Member role update
Trigger: A member's roles change.
Recommendation: Enable — ensures tokens reflect the updated role set immediately.
Enabling a toggle does not immediately end an active session. It invalidates the refresh token, so the session ends the next time the client attempts to obtain a new access token — at which point the user must re-authenticate.
Public sign-up is an application setting for non-federated login flows in which user sign-up is handled directly by Mosaic. When enabled, Mosaic can automatically create a new user the first time they sign in through a direct application login flow. For B2B applications, this setting does not control provisioning through the organization's identity provider: members are still created on their first successful federated login, regardless of the public sign-up setting.
Non-federated login attempts that would create a user when public sign-up is disabled return 403 public_signup_disabled.
For B2B applications that use an invite-only model — where an organization admin adds the member and sends the invitation — disable public sign-up so that self-registration is not available in non-federated flows outside the invite flow. To review or change this setting:
- Per application: open Applications > your app > Advanced settings tab and disable Public sign-up (see Manage applications).