> ## Content Index
> Fetch the complete content index at: https://blog.fabrixly.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How to Use Flexible Authentication with Fabrixly-IDS
- URL: https://blog.fabrixly.com/how-to-use-flexible-authentication-3/
- Published: 2026-07-07T14:10:48.000Z
- Updated: 2026-07-07T14:38:44.000Z
- Author: Fabrixly
- Tags: Documentation

## Overview

Flexible authentication gives **users a choice**! They can either enter their password for quick login OR leave it blank to get an OTP! This is the most user‑friendly auth mode!

## Step 1: Configure Flexible Mode for Your Client

First, configure your Fabrixly-IDS client for flexible auth:

### Admin Console Setup

1. Open **Fabrixly-IDS Admin Console** → **Clients**
2. Select or create a client → click **Edit**
3. Under **Authentication Settings**:
  - **Auth Mode**: select `Flexible`
  - **Enable Mobile Login**: toggle on/off
  - **OTP Delivery Method**: choose email/SMS/both
4. Save!

### API Setup

### Authenticating API Requests

Management API endpoints (like `/api/clients`, `/api/users`, etc.) require administrative authentication. To call them:

1. **Include the Token in the Authorization Header**: Add `-H "Authorization: Bearer <your-admin-jwt-token>"` to your API calls.

**Obtain an Admin JWT Token**:

```bash
curl -X POST https://ids.fabrixly.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "admin@example.com",
    "password": "your-admin-password"
  }'

```

*Note: This returns a JSON response containing a `token`.*

```bash
curl -X POST https://ids.fabrixly.com/api/clients \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <your-admin-jwt-token>" \
  -d '{
    "client_name": "Flexible Auth App",
    "redirect_uris": ["http://localhost:3005/callback"],
    "response_types": ["code"],
    "grant_types": ["authorization_code", "refresh_token"],
    "token_endpoint_auth_method": "client_secret_basic",
    "auth_mode": "flexible",
    "otp_delivery_method": "email"
  }'

```

## User Login Flow

1. User visits your app → clicks "Login"
2. Redirected to Fabrixly-IDS login form
3. User enters email/mobile number → then **chooses**:
  - **Option A**: Enter password → click "Sign In" (password login)
  - **Option B**: Leave password field blank → click "Send OTP" → wait for OTP → enter it → click "Verify & Log In" (passwordless)
4. User logs in successfully!

## Example Flexible Auth Express App

Create `flexible-auth-app.js`:

```javascript
const express = require('express');
const session = require('express-session');
const { Issuer, generators } = require('openid-client');

const app = express();
const PORT = 3005;

app.use(session({
  secret: 'flexibility-is-awesome',
  resave: false,
  saveUninitialized: true
}));

async function init() {
  const issuer = await Issuer.discover('https://ids.fabrixly.com/oidc');
  return new issuer.Client({
    client_id: 'your-flexible-client-id',
    client_secret: 'your-flexible-client-secret',
    redirect_uris: ['http://localhost:3005/callback']
  });
}

let client;
init().then(c => client = c);

app.get('/', (req, res) => {
  if (req.session.user) {
    res.redirect('/dashboard');
  } else {
    res.send(`
      <h1>Flexible Authentication Example</h1>
      <p>Users choose between password or OTP!</p>
      <a href="/login">Login</a>
    `);
  }
});

app.get('/login', (req, res) => {
  req.session.state = generators.state();
  req.session.nonce = generators.nonce();
  
  const authUrl = client.authorizationUrl({
    scope: 'openid profile email',
    state: req.session.state,
    nonce: req.session.nonce
  });
  res.redirect(authUrl);
});

app.get('/callback', async (req, res) => {
  const params = client.callbackParams(req);
  const tokenSet = await client.callback(
    'http://localhost:3005/callback',
    params,
    { state: req.session.state, nonce: req.session.nonce }
  );
  req.session.tokenSet = tokenSet;
  req.session.user = await client.userinfo(tokenSet.access_token);
  res.redirect('/dashboard');
});

app.get('/dashboard', (req, res) => {
  if (!req.session.user) return res.redirect('/');
  
  res.send(`
    <h1>Welcome to Flexible Auth!</h1>
    <p>Hi ${req.session.user.email}! You logged in via either password or OTP!</p>
    <a href="/">Home</a>
  `);
});

app.listen(PORT, () => console.log(`Flexible auth app running on http://localhost:${PORT}`));

```

## Why Use Flexible Authentication?

1. **Best User Experience**: Users pick what's most convenient for them!
2. **Fallback**: If a user forgets their password, they can just use OTP instead!
3. **Familiar**: Users who like passwords can keep using them; users who like passwordless can use OTP!

## Use Cases

- **SaaS apps**: Give users choice
- **Internal tools**: Some employees prefer passwords, others prefer OTP
- **Consumer apps**: Cater to all user preferences!

## Security Best Practices

- Still use HTTPS!
- Keep OTP expiry short!
- Rate limit both password attempts and OTP requests!

## Troubleshooting

- **User can't get OTP**: Make sure they left password field blank!
- **Form doesn't show both options**: Verify client's `auth_mode` is `flexible`!

## Next Steps

- Try magic links for even more simplicity!
- Explore social logins!