Identity tutorials
Each tutorial starts with a working Identity tenant and ends with an observable result. Follow one guide from beginning to end, then use the API reference when you need every field, response or error variant.
Keep the tenant issuer explicit throughout a tutorial. An account is identified by (issuer, subject), and an access token is valid only for its intended audience.
Build login, callback validation, server-side token storage, refresh and product-account binding.
Use a JavaScript OIDC client, understand browser token ownership and check the current deployment constraint.
Delegate registration, login, MFA and consent to Identity while AppAuth owns the native OAuth callback.
Explain and implement the complete registration state machine, from interaction creation through the first login.
Start a native interaction, submit a password, handle MFA and exchange the resulting code.
Validate tokens locally, require the correct audience and scope, and use live introspection where revocation matters.
Create a tenant, register its API and web client, then verify discovery before handing the environment to a customer.
Model an organization, team, permission and role assignment without moving product-owned business data.
Validate a canonical export, create accounts, consume every result page and persist exact subject bindings.
How to use these guides
Replace example domains, identifiers and secrets with values from one environment. Run the verification step after each mutation instead of waiting until the end. When a request fails, use its HTTP status and error code with responses and errors; do not continue with partial state.
Choose the login boundary first
| Application | Default integration | Alternative |
|---|---|---|
| web application with a backend | BFF keeps OAuth tokens server-side | browser-only public client when the OAuth endpoints are same-origin |
| mobile application | AppAuth opens hosted login in the system browser | native credential APIs when the product must own the credential screens |
The alternatives change who owns credentials and tokens. They do not change the tenant issuer, the Authorization Code + PKCE boundary or the (issuer, subject) product identity key.