{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","tabs","tab"]},"redocly_category":"Guides","product":"Identity Management","type":"markdown"},"seo":{"title":"Set up machine-to-machine access for a partner service","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"set-up-machine-to-machine-access-for-a-partner-service","__idx":0},"children":["Set up machine-to-machine access for a partner service"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Follow the steps below to configure this scenario. The linked guides provide additional field descriptions and implementation details."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Real-life example:"]}," Acme Retail runs a web shop where customers sign in through a browser redirect. A CRM partner syncs customer profiles every night: the partner's backend calls the Mosaic user APIs with its own client credentials, and no customer signs in."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Use case:"]}," a partner service that calls Mosaic APIs. The partner service authenticates using its own credentials and calls APIs without a user signing in."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resulting structure:"]}," one Mosaic application with two clients: a redirect-based web client for your web app, assigned to an SSO client group, and a separate ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service client"]}," for the partner's machine-to-machine (M2M) integration. The service client has client roles granting the required Mosaic API permissions and doesn't use an SSO client group."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/use_case_partner_m2m.9189f706c85b98bcbbf67b30cbac2a5be724c5bbce37546bc67b44eb2f2f65e9.bdd3aebe.svg","alt":"Example: the Acme Retail Mosaic application has a redirect-based web shop client in an SSO client group and a separate service client for the CRM partner. The service client authenticates with its own credentials and client roles, without a user or an SSO client group."},"children":[]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Not this use case?"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/use_cases"},"children":["Choose a setup for your use case"]}," to compare all setups."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"before-you-start","__idx":1},"children":["Before you start"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Have the following ready:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your web app's redirect URI (OIDC) or ACS URL and Entity ID (SAML)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The Mosaic APIs the partner calls and the permissions each one requires. See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/api_ref_overview/"},"children":["API reference"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-create-the-mosaic-application","__idx":2},"children":["Step 1: Create the Mosaic application"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the Admin Portal, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," and create a Mosaic application, or open the Mosaic application you already use for your web app. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/create_new_application"},"children":["Create Mosaic applications"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Configure the authentication methods your users will use in the Mosaic application's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication methods"]}," tab. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_methods_customize"},"children":["Customize login methods"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Add both clients to the same Mosaic application: the partner's client access token authorizes operations within this Mosaic application. Operations across all Mosaic applications of the tenant require a management app; see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/management_apps"},"children":["Management apps"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-prepare-the-sso-client-group-and-login-journey","__idx":3},"children":["Step 2: Prepare the SSO client group and login journey"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The web client is journey-orchestrated, so it needs an SSO client group. Every journey-orchestrated client must select an SSO client group, even when no other client shares its session. The service client doesn't use a group."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create the SSO client group."]}," In ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," > Application > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Clients"]}," > SSO client groups, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add SSO client group"]}," for the web client, and configure:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SSO client group name"]},": a name that identifies the group."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login screens"]},": ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Hosted by Transmit Security"]}," for Mosaic-hosted pages, or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Self managed (Custom UI)"]}," for a page you host."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login page URL"]},": for self-managed screens, the address of the page you host. For hosted screens, Mosaic generates the URL; to show users a URL on your own domain, enter a custom login page URL. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/deployment/custom_domains"},"children":["Configure custom domains"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Session timeout"]},": how long the group's session stays valid. Default: 14 days, up to 1 year."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Save the group. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_config_service#client-groups"},"children":["Configure SSO"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create the SSO journey."]}," In ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["B2C"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["B2B Identity"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journeys"]},", select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add blank journey"]}," and choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SSO-Journey"]},". Build the login flow with the authentication methods configured in Step 1, then save the journey. You can also reuse an existing SSO journey. The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journeys"]}," section of ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_config_service#journeys"},"children":["Configure SSO"]}," explains where SSO journeys are created and how clients select them."]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For a step-by-step example using Mosaic-hosted screens and email OTP, follow ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/sso/sso_tutorial"},"children":["Create an SSO journey with the Mosaic-hosted experience"]},". Adapt the journey by adding or replacing steps to match your authentication methods and login requirements."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-add-the-web-client","__idx":4},"children":["Step 3: Add the web client"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," > Application > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Clients"]},", select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add client"]},", choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User authentication client"]},", and complete the wizard in the tab that matches the web app's protocol."]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"OIDC web app","disable":false},"children":[{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["General"]},": enter the client name and description."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication flow"]},": leave ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Does your login use OIDC or SAML authentication?"]}," enabled, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OIDC"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client type"]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Web app"]},", and enter the web app's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Redirect URIs"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]},": select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey-orchestrated"]},", the SSO client group, and the SSO journey from Step 2. For Mosaic-hosted screens, select a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Style"]}," or use the default Mosaic style. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/platform/hosted_ui_styles"},"children":["Manage styling for the Mosaic-hosted SSO experience"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Advanced settings"]},": choose the client authentication method and review token lifetimes. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/configure_oidc_client#step-4---advanced-settings"},"children":["OIDC advanced settings"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client roles"]},": select the roles the client needs to call Mosaic APIs. If you don't select a role, the client implicitly receives the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["App Admin"]}," role. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_client_roles"},"children":["Manage client roles"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Save the client. Mosaic generates the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["client ID"]}," and the credentials for the selected authentication method; they're available from the client details page. For all fields, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/configure_oidc_client"},"children":["Configure an OIDC client"]},"."]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"SAML web app","disable":false},"children":[{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["General"]},": enter the client name and description."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication flow"]},": leave ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Does your login use OIDC or SAML authentication?"]}," enabled, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SAML"]},", and enter the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service provider (SP) ACS URL"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service provider (SP) Entity ID"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]},": select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey-orchestrated"]},", the SSO client group, and the SSO journey from Step 2. For Mosaic-hosted screens, select a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Style"]}," or use the default Mosaic style. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/platform/hosted_ui_styles"},"children":["Manage styling for the Mosaic-hosted SSO experience"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Additional information"]},": select the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["NameID"]}," and review assertion signing, ACS validation, and the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Same Site"]}," cookie policy. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/configure_saml_client#step-4---additional-information"},"children":["SAML additional information"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["SAML clients have no Client roles step."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Save the client. Mosaic generates the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SAML SSO URL"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Transmit Entity ID"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["X.509 Certificate"]},", and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["IDP metadata URL"]}," to configure in the app, which acts as the service provider. For all fields, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/configure_saml_client"},"children":["Configure a SAML client"]},"."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-4-add-the-service-client","__idx":5},"children":["Step 4: Add the service client"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," > Application > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Clients"]},", select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add client"]},", choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service client"]},", and complete the wizard:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["General"]},": enter a name that identifies the partner."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Advanced settings"]},":",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication method"]},": select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Private key JWT"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS (self-signed)"]},", or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS (CA-signed)"]},", and configure the keys or certificates required by that method. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/configure_service_client#step-2---advanced-settings"},"children":["Service client advanced settings"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token timeout configuration"]},": review the token lifetimes."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client roles"]},": select or create roles that grant only the permissions the partner needs. If you don't select a role, the client implicitly receives the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["App Admin"]}," role, so always select a restricted role for a partner. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_client_roles"},"children":["Manage client roles"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Save the client and provide the partner with its ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["client ID"]}," and the credentials or configuration required by the selected authentication method. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/configure_service_client"},"children":["Configure service clients"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-5-integrate-the-web-app-and-the-partner-service","__idx":6},"children":["Step 5: Integrate the web app and the partner service"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Integrate your web app with its own client, using the tab that matches its protocol."]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"OIDC web app","disable":false},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Send an authorization request with the client ID and redirect URI, exchange the returned code for user tokens from your backend, and validate the tokens before creating the app's local session. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_quickstart_hosted_ui_oidc"},"children":["Launch OIDC SSO with the Mosaic-hosted experience"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/validate_tokens"},"children":["Validate tokens"]},"."]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"SAML web app","disable":false},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Redirect users to the client's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SAML SSO URL"]},", then verify the SAML response and assertion at the ACS URL before creating the app's local session. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_quickstart_hosted_ui_saml"},"children":["Launch SAML SSO with the Mosaic-hosted experience"]},"."]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the SSO client group uses ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Self managed (Custom UI)"]},", build the login page with the Mosaic Platform SDK, which runs the SSO journey, and host it at the group's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login page URL"]},". See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_quickstart_selfhosted_ui"},"children":["Build your SSO page"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Have the partner integrate its service client:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The partner obtains a client access token from the token endpoint with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_credentials"]}," grant. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/retrieve_client_tokens"},"children":["Get client access tokens"]},". For other authentication methods, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_fapi_private_key_jwt"},"children":["Authenticate with private key JWT"]}," or ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_fapi_mtls"},"children":["Authenticate using mTLS"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The partner calls Mosaic APIs with the access token as a Bearer token."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"check-the-result","__idx":7},"children":["Check the result"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To test login, use a user who belongs to this Mosaic application. Create one from ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Users"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add Users"]},", enter an email address, and select this Mosaic application. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_users#create-edit-or-delete-users"},"children":["Manage users"]},". A login method based on email OTP can sign this user in; for passwords or passkeys, the user must register the credential first."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Users sign in to the web app through its redirect-based client."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The partner's client access token includes the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ts_roles"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ts_permissions"]}," claims of the assigned roles."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Partner requests to APIs covered by the roles succeed. Requests that require other permissions are denied."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Partner requests involve no user sign-in and no SSO session."]}]}]},"headings":[{"value":"Set up machine-to-machine access for a partner service","id":"set-up-machine-to-machine-access-for-a-partner-service","depth":1},{"value":"Before you start","id":"before-you-start","depth":2},{"value":"Step 1: Create the Mosaic application","id":"step-1-create-the-mosaic-application","depth":2},{"value":"Step 2: Prepare the SSO client group and login journey","id":"step-2-prepare-the-sso-client-group-and-login-journey","depth":2},{"value":"Step 3: Add the web client","id":"step-3-add-the-web-client","depth":2},{"value":"Step 4: Add the service client","id":"step-4-add-the-service-client","depth":2},{"value":"Step 5: Integrate the web app and the partner service","id":"step-5-integrate-the-web-app-and-the-partner-service","depth":2},{"value":"Check the result","id":"check-the-result","depth":2}],"frontmatter":{"title":"M2M access for a partner service","seo":{"title":"Set up machine-to-machine access for a partner service"}},"lastModified":"2026-10-15T11:23:16.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/user/use_case_partner_m2m","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}