# Create applications

To integrate with Mosaic, first create an application in the Mosaic Admin Portal. After the application is created, client setup continues either from the application details page or from the SSO Service configuration, depending on your implementation.

Choose the Admin Portal for your environment and region:

- [Sandbox portal](https://portal.sbx.transmitsecurity.io/) for testing and development
- [Portal for global customers](https://portal.transmitsecurity.io/) for US-hosted tenants
- [Portal for EU customers](https://portal.eu.transmitsecurity.io/) for EU-hosted tenants
- [Portal for CA customers](https://portal.ca.transmitsecurity.io/) for CA-hosted tenants
- [Portal for AU customers](https://portal.au.transmitsecurity.io/) for AU-hosted tenants
- [Portal for JP customers](https://portal.gasne1-ts01.transmitsecurity.io/) for JP-hosted tenants


## Create an application

1. In the Admin Portal, go to **Management** > **Applications**.
2. From the **Applications** page, click **Create application**.
3. In the **Create application** drawer, enter the basic application details:
  - **Application name**: Required display name for the application
  - **Application description**: Optional short description shown in the Admin Portal
  - **Application logo**: Optional logo that can be used in Admin Portal and branding-related experiences
4. Click **Save**.


After you save the application, it appears in the **Applications** list. Select the application to open its details page, where you can continue with client creation and additional configuration.

## Configure clients

What comes after application creation
Creating an application is the shared starting point for Mosaic integrations.

After that, choose the client setup that matches your architecture:

- **App clients** are configured inside the application and are used for regular application integrations (for example, end-user authentication, backend-based authentication, and API-only service integrations).
- **SSO clients** are configured as part of the **SSO Service** and are used when apps participate in a centralized SSO experience.


App clients
1. Open the application you just created and go to **Clients**.
2. Click **+ Add client**.
3. Choose the client path that matches your use case:
  - For end-user authentication or backend-based authentication tied to your application, select **User authentication client** and then continue with either protocol-based authentication ([OIDC](/guides/user/manage_clients#oidc-flow) or [SAML](/guides/user/manage_clients#saml-flow)) or backend-based authentication with OIDC/SAML authentication turned off.
  - For API-only backend-to-backend service integrations, select a [service client](/guides/user/manage_clients#service-client-flow).
4. Complete the basic settings for the client type you selected, then click **Save**.


For the full application-client procedures, see [Manage clients](/guides/user/manage_clients).

SSO clients
1. Go to **SSO and Federation** > **Configuration** and configure the SSO experience.
2. Create an [SSO journey](/guides/user/sso_orchestration/sso_journeys), or reuse an existing one, to define the authentication logic and login experience used by your SSO implementation.
3. In **SSO and Federation** > **Configuration** > **Client groups**, create a client group and associate it with the appropriate SSO journey. Client groups let you apply the same SSO journey and related settings to multiple relying-party apps.
4. Add the relying-party clients to the client group using either **OIDC** or **SAML**. The clients in the group are the apps that will use that shared SSO configuration.
5. If you also need a client for API-based management operations, configure an SSO management client. For the complete SSO procedure, see [Configure SSO Service](/guides/user/sso_orchestration/sso_config_service).