{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"redocly_category":"Guides","product":"Identity Management","type":"markdown"},"seo":{"title":"Implement B2B login with APIs","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"implement-b2b-login-with-apis","__idx":0},"children":["Implement B2B login with APIs"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this guide when your client's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]}," is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application-controlled"]},". For ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey-orchestrated"]}," clients, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_build_journeys"},"children":["Build the B2B journeys"]}," instead. Your application provides the screens, identifies the member's organization, and calls Mosaic's authentication APIs. Mosaic authenticates the member and issues tokens in that organization's context."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"before-you-start","__idx":1},"children":["Before you start"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Complete the shared ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_setup-overview"},"children":["B2B setup"]}," through ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Set members"]},", including:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A Mosaic application and an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application-controlled"]}," client — see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_configure_app_client"},"children":["Configure app & client"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Organizations associated with the application, with their member email domains registered — see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_create_organization"},"children":["Create organizations"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Members with access to the application in the relevant organization — see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/b2b/b2b_set_members"},"children":["Set members"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The authentication requests below run from your backend and use a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/retrieve_client_tokens"},"children":["client access token"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-identify-the-organization","__idx":2},"children":["Step 1: Identify the organization"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Establish which organization the member is signing in to before initiating member authentication. Your customer-facing application must supply this context; it cannot assume a default organization."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Applications usually identify the organization through one of these approaches:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A dedicated subdomain or URL for each business customer."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Their own mapping of customers to Mosaic organizations."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Asking the member to choose an organization."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/user/organizations.openapi"},"children":["Organizations API"]}," retrieves an organization by ID or name, and lists organizations filtered by name or application. It does not expose an endpoint or filter that maps an email domain to an organization. If your application uses email domains for routing, maintain that mapping in your own code or data."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Keep the resolved organization ID for the authentication request. If a member belongs to multiple organizations, your application also determines which one they are signing in to."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-implement-the-authentication-flow","__idx":3},"children":["Step 2: Implement the authentication flow"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your application decides which authentication operations to run and provides the screens for collecting credentials. It must handle the logic for each organization's authentication configuration, including authenticator registration and MFA where required."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Follow the integration guide for the methods your application uses, such as ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/be_auth_email_otp"},"children":["Email OTP"]},", ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/be_auth_passwords"},"children":["Passwords"]},", or ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/be_auth_email_magic_link"},"children":["Email magic links"]},". Those guides describe the method-specific sequence; supply the organization's ID as described below to authenticate a B2B member."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-authenticate-in-the-organization-context","__idx":4},"children":["Step 3: Authenticate in the organization context"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Pass the resolved ID as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["org_id"]}," in the backend authentication request. The ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/user/backend-one-time-login.openapi/other/authenticateotp"},"children":["OTP"]},", ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/user/backend-passwords.openapi/other/authenticatepassword"},"children":["password"]},", and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/user/backend-one-time-login.openapi/other/authenticatemagiclink"},"children":["magic link"]}," authentication endpoints support this field for B2B member login."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For example, after sending an email OTP and collecting the code, send this JSON body to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /v1/auth/otp/authenticate"]},", using the header ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization: Bearer <CLIENT_ACCESS_TOKEN>"]},":"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"identifier_type\": \"email\",\n  \"identifier\": \"member@agency.com\",\n  \"passcode\": \"<OTP_ENTERED_BY_MEMBER>\",\n  \"org_id\": \"<ORGANIZATION_ID>\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Replace the identifier, passcode, and organization ID with the values for the current login. In this flow, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["org_id"]}," belongs in the OTP authentication request; the OTP send request does not accept it. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/be_auth_email_otp"},"children":["Login with Email OTP"]}," for the complete send-and-authenticate sequence."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-4-validate-the-result","__idx":5},"children":["Step 4: Validate the result"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After authentication succeeds, ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/validate_tokens"},"children":["validate the returned tokens"]}," before granting access. Test the flow with members of the organizations your application serves, including a member with access to more than one organization, to verify that your application uses the intended organization context."]}]},"headings":[{"value":"Implement B2B login with APIs","id":"implement-b2b-login-with-apis","depth":1},{"value":"Before you start","id":"before-you-start","depth":2},{"value":"Step 1: Identify the organization","id":"step-1-identify-the-organization","depth":2},{"value":"Step 2: Implement the authentication flow","id":"step-2-implement-the-authentication-flow","depth":2},{"value":"Step 3: Authenticate in the organization context","id":"step-3-authenticate-in-the-organization-context","depth":2},{"value":"Step 4: Validate the result","id":"step-4-validate-the-result","depth":2}],"frontmatter":{"markdown":{"toc":{"depth":2}},"navigation":{"previousButton":{"text":"Previous:","hide":false,"label":"Set members","link":"/guides/user/b2b/b2b_set_members"},"nextButton":{"hide":true}},"seo":{"title":"Implement B2B login with APIs"}},"lastModified":"2026-10-21T10:11:50.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/user/b2b/b2b_login_with_apis","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}