Documentation/Studio
Back
  • Getting started
    • Key concepts
    • Sign in
    • Create and switch organisations
  • Registers
    • Create and change a register
    • Upload and download entries
    • Add, edit and deactivate entries
    • Groups
    • Challenge codes
    • Connect and test an external register
    • Register activity
  • Membership definition
    • Add and order register assignments
    • Filters and outcomes
    • Preview before saving
    • Save and version history
  • Member code query
  • Members directory
    • Find a member
    • Look up the checks of a member code
    • Deactivate a membership
  • Communities
    • Create, rename and delete a community
    • Filter by register, status, groups and claims
  • Frontends
    • Create a frontend
    • Frontend keys
    • Sign-in settings
    • Sign-in branding
  • Login with appsolut
    • Sign-up and onboarding
    • Sign-in and sign-out
    • Support requests
  • Frontend users
    • Find a frontend user
    • Membership and activations
    • Block a frontend user
    • Export a frontend user's data
    • Disconnect a frontend
  • Membership check
    • Check modes
    • Results and the check log
    • Rate limits
    • Grace rule
  • Organisation settings
    • Organisation profile
    • Studio users and roles
    • Billing
    • Roadmap and feature requests

Sign-in settings

Set up a frontend for Login with appsolut: app type, redirect URIs, start URL and its sign-in client.

Studio roles: "Owner", "Administrator" and "Frontend manager".

The sign-in settings let a frontend sign its users in with Login with appsolut. When you first save them, the Studio sets up the frontend's sign-in client and shows its client ID and client secret, which the frontend's backend needs.

For now, only internal frontends that are web apps can sign users in. An external frontend shows "External frontends cannot sign users in yet": sign-in for external frontends follows in December. The other app types ("Single-page app", "Mobile app", "Desktop app" and "Server") are marked "Later".

Set up sign-in

  1. Open "Frontends" and choose the frontend, for example "Pannoniqa Portal".
  2. Under "Sign-in", choose the "App type" "Web app": a website with its own backend, which keeps the client secret.
  3. Under "Redirect URIs", enter the address the frontend's developers give you, for example https://portal.pannoniqa.example/api/auth/callback. After signing in, frontend users return to one of these addresses. Choose "Add redirect URI" for another one, up to 10.
  4. Under "Start URL", enter the page where frontend users go when there is no sign-in to return to, such as after resetting their password, for example https://portal.pannoniqa.example/.
  5. Choose "Save sign-in settings".
  6. The dialog "Your frontend's sign-in client" shows the "Client ID" and the "Client secret". Copy both and give them to the frontend's developers, who store them in its backend.
  7. Choose "I have stored the secret".

The secret is shown only once: the Studio does not keep it. The client ID stays visible under "Sign-in"; it is not secret.

Frontend users see the frontend's name on the sign-in screens. There is no separate display name: to change it, change the name under "Settings".

Rules for the addresses

  • A redirect URI uses https, or http only on localhost or 127.0.0.1 for local development.
  • It is exact: the frontend must send the address character for character as it is entered here. There are no wildcards.
  • It has no fragment (#), no *, no commas and no spaces.
  • The start URL follows the same rules, and its origin (scheme, host and port) must match one of the redirect URIs.

Rotate the client secret

If the secret is lost or may have leaked, issue a new one.

  1. Under "Sign-in", choose "Rotate secret".
  2. Read the warning "The old secret stops working at once" and choose "Rotate secret".
  3. Copy the new secret from "Your new client secret" and choose "I have stored the secret".

There is no overlap: the frontend fails every sign-in until the new secret is deployed to its backend. Rotate when the developers are ready to deploy it straight away.

When the sign-in client is missing

  • "This frontend has no sign-in client yet": the settings were saved, but the client could not be set up. Save the settings again.
  • "The sign-in client no longer exists": choose "Recreate client". The new client has a new client ID and secret, which the developers deploy to the frontend's backend.
  • "Sign-in is not available at the moment": the sign-in service is not answering. Try again later.

How the frontend's developers use the client ID and secret is in the developer documentation.