How to Manage Clients in the Admin Console

This guide walks you through registering new applications (OIDC Clients), rotating credentials, and configuring user authentication flows using the Admin Console.

1. Creating a New Client Application

1. Log in to the Admin Console and navigate to the Clients section.
2. Click the Create Client button in the top-right corner.
3. Fill in the General Information:
   • Client Name: A recognizable name for your app (e.g. Corporate Portal or Sales Mobile App).
   • Client ID: (Optional) Enter a unique slug (e.g., corp-portal-app). If left blank, Fabrixly-IDS will auto-generate one.

2. Choosing the Application Type & Grant Types

Depending on your application stack, select the appropriate options:

• Single Page App (React, Angular, Vue):
  • Response Types: code
  • Grant Types: authorization_code, refresh_token
  • Token Endpoint Auth Method: none (Required for PKCE public clients).
• Traditional Web App (Next.js server-side, Express, Spring Boot, Python):
  • Response Types: code
  • Grant Types: authorization_code, refresh_token
  • Token Endpoint Auth Method: client_secret_post or client_secret_basic.
• Machine-to-Machine (Microservices, Cron Jobs, Daemons):
  • Grant Types: client_credentials
  • Token Endpoint Auth Method: client_secret_basic.

3. Configuring URIs & Allowed Redirects

• Redirect URIs: Enter the Callback URL(s) of your app where OIDC authorization codes should be sent (e.g., http://localhost:3000/api/auth/callback/fabrixly).
  • Security Note: Wildcards are not allowed. Specify exact URLs.
• Post Logout Redirect URIs: URLs where users are sent after signing out of their OIDC session (e.g. http://localhost:3000/login).

4. Selecting User Login Methods (Auth Modes)

Configure how end-users authenticate when signing in to this specific client application:

• Password: Standard username + password.
• OTP-only: Passwordless authentication via SMS or email code.
• Password + OTP: Two-factor authentication (2FA).
• Flexible: Users choose between password, OTP, or magic link sign-in.
• Magic Link: Passwordless authentication via email token link.

5. Configuring Social Logins (Google & GitHub)

Toggle external social identity providers for your client:

1. Scroll down to the Social Logins section.
2. Select Google and/or GitHub.
3. Enter the provider credential keys:
   • Client ID: Paste your Google/GitHub app ID.
   • Client Secret: Paste your Google/GitHub client secret.
4. Save changes. Google and GitHub buttons will now render on your client's login screen.

6. Managing Credentials & Secret Rotation

For traditional server-side and machine-to-machine apps:

1. Open the client details page.
2. Locate the Client Secret field (masked by default). Click Reveal to copy it into your environment file (.env).
3. Secret Rotation: If a key is compromised, click Rotate Secret. The console generates a new secret key instantly. Copy and update your server configurations immediately.