Frontends and app types
What a frontend is from a developer's view, and what the organisation gives you for it.
A frontend is an app an organisation's people sign in to with Login with appsolut. In the Studio, each frontend is one record under "Frontends", and each frontend is exactly one OAuth client.
What decides how a frontend works
The organisation sets these on the frontend's page in the Studio:
- Kind: "Internal" (a website or mobile app of the organisation's own) or "External" (an app of someone else that the organisation connects). The kind is fixed when the frontend is created.
- Community: exactly one community serves the frontend and decides which members may use it. For the Pannoniqa Portal it is "All staff", for the Pannoniqa App "Active employees".
- Membership mandatory: on by default. With it, only valid members of the frontend's community get a token; without it, anyone with an account can sign in, and the token says whether they are a member.
- App type: what kind of app the frontend is. It decides whether the frontend can keep a client secret and which redirect URIs it may use.
| App type | In the Studio | What it is |
|---|---|---|
web | "Web app" | A website with its own backend, which keeps the client secret |
spa | "Single-page app" | An app that runs only in the browser, without a backend |
mobile | "Mobile app" | An app for iOS or Android |
desktop | "Desktop app" | An app installed on a computer |
server | "Server" | A service that signs in without a user |
Today only internal web apps can sign users in. The Studio offers the other app types as "Later", and an external frontend's "Sign-in" card says that sign-in for external frontends follows in December. A web app is a confidential OAuth client: it keeps its client secret and its users' tokens on its own server.
What you get from the organisation
A Studio user who may manage frontends (the Studio roles "Owner", "Administrator" and "Frontend manager") sets up the frontend and hands you:
| What | Where it comes from | Used for |
|---|---|---|
| Client ID | The frontend's "Sign-in" card | Login with appsolut |
| Client secret | Shown once when the sign-in client is created or the secret is rotated | Exchanging codes for tokens |
| Frontend key | Shown once when a key is issued on the frontend's "Keys" card | Calling the Members API |
| The organisation's ID | Ask appsolut for it, with the client ID; the Studio does not show it yet | Checking tenant_id in tokens |
They also need from you the frontend's redirect URIs and its start URL: see Redirect URIs and start URL.
The client secret and the frontend key are different secrets for different calls: the secret only for the token endpoint, the key only for the Members API. Never use one in place of the other.
A frontend that is switched off
An organisation can disconnect a frontend ("Disconnect frontend"). From then on it signs no one in, every sign-in session of it ends, and its frontend keys are refused. Its settings, keys and sign-in client are kept, so reconnecting it restores both; users who were signed out sign in again. See Revocation.