Manage applications

Applications and clients can be managed either using Management APIs, or from the Admin Portal (as described below).

The Applications page presents a list of all your applications, including basic details like the application ID and name, when it was created, which admin created it, and the last time a user logged in. You can search for a specific application by name using the search box on the top-right, and click to view the Application settings.

When you open an application, you can view its associated clients and configure app-level settings shared across those clients, such as Authentication methods, Advanced settings, User roles, and B2B Settings when relevant.

You can manage your applications from the Applications page:

• Create an app by clicking Create application and configuring Application settings.
• Edit an app by clicking and then Edit.
• Delete an app by clicking and then Delete.

Each application row includes basic information such as:

• Application ID: Application identifier, automatically generated when the app is created. It cannot be edited.
• Application name: Name of your application, displayed in the Admin Portal.
• Application description: Short description of your application, displayed in the Admin Portal.

You can access your application settings from the Applications page by clicking the relevant application in the table. Depending on your setup, the application details page can include the following tabs:

• Clients
• Authentication methods
• Advanced settings
• User roles
• B2B Settings

This tab contains the clients that request Mosaic services for the application, such as your retail website, mobile app, backend, or third-party service. To build identity experiences with Mosaic, you need at least one client for the app. You can add multiple clients and support a multi-client application setup. Depending on your needs, Mosaic lets you create User authentication clients for OIDC, SAML, or backend-based authentication, as well as Service clients for API-only service integrations. See Manage clients.

Use this tab to configure which authenticators the application supports and how they behave. This includes method-specific settings such as password policy, OTP expiration, passkey relying-party settings, social provider credentials, and the branding used by email-based authentication methods.

For step-by-step guidance, see Customize login methods. For hosted-login flow layout, branding, and language, see Manage your hosted login experience and Brand your hosted login experience.

Advanced app settings include:

• Application domain: Configure the application's unique domain. You can use either an Application sub domain generated under the Mosaic domain suffix, or an Application custom domain that uses a domain you own. This domain is used as the app-specific issuer for tokens and related OIDC endpoints. Custom domains require additional provisioning with Transmit Security. For more, see Manage token signing keys and Configure custom domains.

• Public sign-up: Allows non-federated login flows to automatically create new users (or associate existing users with the application) the first time they log in. When enabled, auto-creation can be requested via the create_new_user parameter of Authentication APIs, or the createNewUser parameter of the OIDC authorization API. When disabled, these requests return 403 public_signup_disabled.

  Public sign-up and B2B

  Public sign-up doesn't apply to SSO provisioning. Members of an organization configured for SAML or OIDC SSO are created on their first successful login through the organization's identity provider, even when this setting is disabled.

• Token signing keys: Control how tokens issued by this application are signed. You can keep using the tenant-level Global signing key, add a system-generated app-specific key, or upload your own key using BYOK. App-specific signing keys require a unique application domain. For more, see Manage token signing keys.

• Authentication Hub: Mark this application as the tenant's centralized login application by selecting Set as authentication hub, and configuring the Authentication hub URL. Other apps in the tenant can delegate sign-in to it, and you can optionally use it for SSO across apps. Only one application can be set as the Authentication Hub for a tenant. See Create an Authentication Hub.

• Service providers: Aattach third-party SAML service providers that should rely on this application for SSO, with Mosaic acting as the SAML identity provider. See Federate SSO with Mosaic SAML IDP.

Use this tab to define the application-level roles your product recognizes, such as booking_agent or finance_admin. Your application can later consume the resulting role values from tokens or APIs for authorization.

In B2B scenarios, these roles are typically grouped into role groups and assigned to organizations. For more about B2B role settings, se Define app roles and Create app role groups.

For B2B applications only, it contains the app-level settings used for organization onboarding and member access. It includes:

• Settings for the member invitation flow, such as the redirect URI, inviting client, and invite-link lifetime.
• Settings for the Organization admin portal offered to organizations so their admins can manage members and access.
• Settings for refresh token invalidation triggers, that determine which member lifecycle events invalidate refresh tokens and force re-authentication in the B2B context.

For full field-level configuration details, see Configure B2B application settings.