{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"redocly_category":"Guides","product":"Identity Management","type":"markdown"},"seo":{"title":"Configure service clients","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"configure-service-clients","__idx":0},"children":["Configure service clients"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service client"]}," path is a three-step flow after the initial client-type selection. Use this path for:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Fraud Prevention"]}," clients that call risk-evaluation APIs and SDKs"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity Verification"]}," clients that call APIs and SDKs"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Machine-to-machine (M2M)"]}," clients for server-to-server integrations"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Platform Administration"]}," clients that call Mosaic management APIs within their Mosaic application, for example to manage the Mosaic application and its clients"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A service client operates within the scope of its Mosaic application. For administrative operations across Mosaic applications, use ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/management_apps"},"children":["management apps"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"before-you-start","__idx":1},"children":["Before you start"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/create_new_application"},"children":["Create a Mosaic application"]}," for the client and identify the API permissions your integration needs."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," > your app > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Clients"]},", click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add client"]}," and select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service client"]},". Complete the three steps below."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1---general","__idx":2},"children":["Step 1 - General"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client name"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client name to display when needed."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client description"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Short description of your client."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2---advanced-settings","__idx":3},"children":["Step 2 - Advanced settings"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication method"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enforces client authentication using a specific method:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]},": (default) Allows authenticating using Client ID and Client Secret. For security purposes, the secret can be rotated later without changing the client ID."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Private key JWT"]},": Allows authenticating using client JWT assertion signed by your private key. If selected, provide ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc7517"},"children":["JWKS"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS (self-signed)"]},": Allows leveraging an mTLS handshake for authentication. If selected, provide the self-signed certificate in the JWKS format."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS (CA-signed)"]},": Allows leveraging an mTLS handshake for authentication. If selected, provide the certificate chain in the PEM format. For requirements, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_fapi_mtls#step-1-obtain-certificates"},"children":["Authenticate using mutual TLS"]},". Optionally, define ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Subject DN"]}," attributes (Common name (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CN"]},"), Organization (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["O"]},"), and others) to enforce certificate validation against these values."]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enable token binding"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enabling this ensures that tokens are cryptographically bound to client certificate in the mTLS and private key JWT flows."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token timeout configuration"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Allows modifying default token expiration times:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access token expiration"]},": The access token time-to-live. By default, 60 minutes."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Refresh token expiration"]},": The refresh token time-to-live. By default, 2 weeks."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Max refresh time"]},": The maximum period of time when the refresh token can be rotated. By default, 2 weeks."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Session expiration"]},": The validity period during which you can silently authenticate the session. By default, 8760 hours (1 year)."]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Additional settings"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resources"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["List of resources the client can explicitly request access to. This allows the client to manage dedicated access for a resource, including the token expiration. Before a resource can be added to a client, it must first be created from the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resources"]}," tab of the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," page (see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_resources"},"children":["Resources"]},")."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token exchange"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lets clients exchange user access tokens using ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc8693"},"children":["OAuth 2.0 Token Exchange (RFC 8693)"]},". Both options are disabled by default.",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Initiate token exchange"]},": Allows this client to call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/oidc/token"]}," with the token exchange grant, as the exchanging client."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delegate tokens issued by this client"]},": Controls which clients may exchange user access tokens issued to this client, as the source client. When enabled, choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["All clients within the Application"]}," (every client in the same Mosaic application, including dynamically registered clients) or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Specific clients / DCR Authorities"]}," (manually registered clients you select, and optionally Client authorities, so that clients registered through them can exchange tokens)."]}]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3---client-roles","__idx":4},"children":["Step 3 - Client roles"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This last step lets you assign access to the service client by selecting an existing client role or creating one inline."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client roles"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Assign one or more client roles to the client. If you don't select a role, the client implicitly receives the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["App Admin"]}," role."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client roles"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add role"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Opens the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add role"]}," flow: ",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Step 1 - Details"]},": enter the required ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Role name"]}," and optional ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Description"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Step 2 - Setup"]},": assign permissions from the permission tree under the Mosaic capability areas ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity management"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Platform Administration"]},", and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Fraud Prevention"]},", each expanding into more granular categories."]}]}," For more details, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_client_roles"},"children":["Manage client roles"]},"."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Service clients don't require redirect URIs, SAML federation, supported prompt values, PKCE, or OIDC token-claim configuration."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"after-saving","__idx":5},"children":["After saving"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Complete the wizard and save the client. Use its client ID and the configured authentication method to authorize your integration. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/retrieve_client_tokens"},"children":["Retrieve client tokens"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-guides","__idx":6},"children":["Related guides"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_clients"},"children":["Manage clients"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_client_roles"},"children":["Manage client roles"]}]}]}]},"headings":[{"value":"Configure service clients","id":"configure-service-clients","depth":1},{"value":"Before you start","id":"before-you-start","depth":2},{"value":"Step 1 - General","id":"step-1---general","depth":2},{"value":"Step 2 - Advanced settings","id":"step-2---advanced-settings","depth":2},{"value":"Step 3 - Client roles","id":"step-3---client-roles","depth":2},{"value":"After saving","id":"after-saving","depth":2},{"value":"Related guides","id":"related-guides","depth":2}],"frontmatter":{"title":"Service clients","markdown":{"toc":{"depth":2}},"seo":{"title":"Configure service clients"}},"lastModified":"2026-10-16T09:43:07.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/user/configure_service_client","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}