{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"redocly_category":"Guides","product":"Identity Management","type":"markdown"},"seo":{"title":"Choose a setup for your use case","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"choose-a-setup-for-your-use-case","__idx":0},"children":["Choose a setup for your use case"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Choose the scenario that matches how users should sign in or how a service should access your APIs. Compare the expected behavior and Mosaic setup, then follow the setup guide in the last column."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["These examples use a single tenant. In the tables, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mosaic application"]}," means the user pool and configuration container in the Admin Portal. Your web apps, mobile apps, and services connect to it through clients."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"single-app","__idx":1},"children":["Single app"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Set up login for one web or mobile app."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Use case"},"children":["Use case"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Expected behavior"},"children":["Expected behavior"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Mosaic setup overview"},"children":["Mosaic setup overview"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Setup guide"},"children":["Setup guide"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Set up login for a web app with Mosaic-hosted pages"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users are redirected to a Mosaic-hosted login page, then return to your web app after authentication."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One Mosaic application"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One user authentication client configured for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OIDC"]}," (",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Web app"]},", with the web app's redirect URI) or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SAML"]}," (with the web app's ACS URL and Entity ID)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey-orchestrated"]}," login with an SSO journey and an SSO client group configured for Mosaic-hosted login"]}]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/user/use_case_web_redirect_login","target":"_blank","rel":"noopener noreferrer","aria-label":"Go to use case: Set up login for a web app with Mosaic-hosted pages"},"children":["Go to use case ",{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/external-link-light.4df94bb69d7e4b3a55938c8f3dcdfbdcbbf62d7475987ed4e85f8f528cad1141.9c1bb791.svg","alt":"","aria-hidden":"true"},"children":[]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Set up backend-based login for a web app"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users sign in within your web app. Your backend authenticates them through the Mosaic backend authentication APIs, without redirecting them to a separate login page."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One Mosaic application"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One user authentication client configured for backend-based authentication: turn off ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Does your login use OIDC or SAML authentication?"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["No SSO client group required for this flow"]}]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/user/use_case_web_direct_login","target":"_blank","rel":"noopener noreferrer","aria-label":"Go to use case: Set up backend-based login for a web app"},"children":["Go to use case ",{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/external-link-light.4df94bb69d7e4b3a55938c8f3dcdfbdcbbf62d7475987ed4e85f8f528cad1141.9c1bb791.svg","alt":"","aria-hidden":"true"},"children":[]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Set up login for a mobile app"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users sign in through a browser redirect or directly within the mobile app, depending on your integration."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One Mosaic application"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One user authentication client for the mobile app, either redirect-based or in-app"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For browser redirects: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OIDC"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Native app"]},", and the mobile app's redirect URI; select an SSO client group and journey for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey-orchestrated"]}," login"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For in-app authentication: the backend-based API or SDK flow, without an SSO client group"]}]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/user/use_case_mobile_app","target":"_blank","rel":"noopener noreferrer","aria-label":"Go to use case: Set up login for a mobile app"},"children":["Go to use case ",{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/external-link-light.4df94bb69d7e4b3a55938c8f3dcdfbdcbbf62d7475987ed4e85f8f528cad1141.9c1bb791.svg","alt":"","aria-hidden":"true"},"children":[]}]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"multiple-apps","__idx":2},"children":["Multiple apps"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Choose how your apps share user accounts and whether users sign in separately or use SSO."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Use case"},"children":["Use case"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Expected behavior"},"children":["Expected behavior"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Mosaic setup overview"},"children":["Mosaic setup overview"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Setup guide"},"children":["Setup guide"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Share user accounts across web and mobile apps"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users use the same account and credentials on web and mobile. Both apps apply the same authentication policies. The mobile app doesn't share a browser session with the web app."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One Mosaic application with two clients: one for the web app, one for the mobile app"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Shared Mosaic application-level authentication settings"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Each client can be redirect-based or backend-based"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["No browser SSO between the two clients: if both are journey-orchestrated, each uses its own SSO client group"]}]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/user/use_case_web_mobile_unified","target":"_blank","rel":"noopener noreferrer","aria-label":"Go to use case: Share user accounts across web and mobile apps"},"children":["Go to use case ",{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/external-link-light.4df94bb69d7e4b3a55938c8f3dcdfbdcbbf62d7475987ed4e85f8f528cad1141.9c1bb791.svg","alt":"","aria-hidden":"true"},"children":[]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enable SSO between web apps"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users sign in to one web app and can access the other without signing in again while the shared session remains valid."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One Mosaic application"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One user authentication client per web app, configured for OIDC or SAML"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One shared SSO client group"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey-orchestrated"]}," login on each client, with the shared group and an SSO journey selected"]}]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/user/use_case_sso_business_units","target":"_blank","rel":"noopener noreferrer","aria-label":"Go to use case: Enable SSO between web apps"},"children":["Go to use case ",{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/external-link-light.4df94bb69d7e4b3a55938c8f3dcdfbdcbbf62d7475987ed4e85f8f528cad1141.9c1bb791.svg","alt":"","aria-hidden":"true"},"children":[]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Share user accounts across apps with separate logins"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users use the same account and credentials across apps, but sign in to each app separately."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One Mosaic application containing all clients"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One user authentication client per app integration"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For journey-orchestrated login: a separate SSO client group for each app, with an SSO journey selected on each client"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For backend-based API or SDK login: no SSO client group"]}]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/user/use_case_shared_identity_no_sso","target":"_blank","rel":"noopener noreferrer","aria-label":"Go to use case: Share user accounts across apps with separate logins"},"children":["Go to use case ",{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/external-link-light.4df94bb69d7e4b3a55938c8f3dcdfbdcbbf62d7475987ed4e85f8f528cad1141.9c1bb791.svg","alt":"","aria-hidden":"true"},"children":[]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Share user accounts with SSO within separate groups of apps"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users use the same account across all apps. Signing in gives them SSO access within one group; other groups require a separate login."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One Mosaic application containing all clients"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One user authentication client per app integration"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One SSO client group for each set of apps that should share browser sessions"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey-orchestrated"]}," clients select their assigned SSO client group and an SSO journey"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Mobile clients use their chosen redirect-based or in-app flow; in-app clients do not join browser SSO"]}]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/user/use_case_shared_identity_sso_per_business_unit","target":"_blank","rel":"noopener noreferrer","aria-label":"Go to use case: Share user accounts with SSO within separate groups of apps"},"children":["Go to use case ",{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/external-link-light.4df94bb69d7e4b3a55938c8f3dcdfbdcbbf62d7475987ed4e85f8f528cad1141.9c1bb791.svg","alt":"","aria-hidden":"true"},"children":[]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Keep user accounts and credentials separate across apps"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users have a separate account and credentials for each app. Signing in to one app does not sign them in to another."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A separate Mosaic application for each isolated user pool; for two apps, create two Mosaic applications"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Each Mosaic application has its own clients and authentication settings"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Journey-orchestrated clients select their Mosaic application's SSO client group and an SSO journey"]}]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/user/use_case_isolated_business_units","target":"_blank","rel":"noopener noreferrer","aria-label":"Go to use case: Keep user accounts and credentials separate across apps"},"children":["Go to use case ",{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/external-link-light.4df94bb69d7e4b3a55938c8f3dcdfbdcbbf62d7475987ed4e85f8f528cad1141.9c1bb791.svg","alt":"","aria-hidden":"true"},"children":[]}]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"partner-access","__idx":3},"children":["Partner access"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Give a partner service access on behalf of a user or through its own credentials."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Use case"},"children":["Use case"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Expected behavior"},"children":["Expected behavior"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Mosaic setup overview"},"children":["Mosaic setup overview"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Setup guide"},"children":["Setup guide"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Allow a partner service to act on behalf of a user"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The partner service accesses resources on behalf of a signed-in user and participates in the same browser SSO session."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One Mosaic application and one SSO client group"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Every channel modeled as a client: web app, mobile app, and the partner, each with its own user authentication client"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["All clients assigned to the same SSO client group, with journey-orchestrated login"]}]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/user/use_case_partner_user_context","target":"_blank","rel":"noopener noreferrer","aria-label":"Go to use case: Allow a partner service to act on behalf of a user"},"children":["Go to use case ",{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/external-link-light.4df94bb69d7e4b3a55938c8f3dcdfbdcbbf62d7475987ed4e85f8f528cad1141.9c1bb791.svg","alt":"","aria-hidden":"true"},"children":[]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Set up machine-to-machine access for a partner service"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The partner service authenticates using its own credentials and calls APIs without a user signing in."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["One Mosaic application"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A redirect-based web client for your web app, in an SSO client group"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A separate ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service client"]}," for the partner's M2M integration, with its own authentication method and credentials"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/user/manage_client_roles"},"children":["Client roles"]}," granting the required Mosaic API permissions"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["No SSO client group for the service client"]}]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/user/use_case_partner_m2m","target":"_blank","rel":"noopener noreferrer","aria-label":"Go to use case: Set up machine-to-machine access for a partner service"},"children":["Go to use case ",{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/external-link-light.4df94bb69d7e4b3a55938c8f3dcdfbdcbbf62d7475987ed4e85f8f528cad1141.9c1bb791.svg","alt":"","aria-hidden":"true"},"children":[]}]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"before-configuring-a-use-case","__idx":4},"children":["Before configuring a use case"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Read ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/apps_and_clients"},"children":["Plan your integration structure"]}," for the identity and session boundaries behind these setups."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Read ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/login_experience"},"children":["Choose your login experience"]}," before configuring a user authentication client."]}]}]},"headings":[{"value":"Choose a setup for your use case","id":"choose-a-setup-for-your-use-case","depth":1},{"value":"Single app","id":"single-app","depth":2},{"value":"Multiple apps","id":"multiple-apps","depth":2},{"value":"Partner access","id":"partner-access","depth":2},{"value":"Before configuring a use case","id":"before-configuring-a-use-case","depth":2}],"frontmatter":{"title":"Choose a setup for your use case","seo":{"title":"Choose a setup for your use case"}},"lastModified":"2026-10-15T11:23:16.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/user/use_cases","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}