> ## Content Index > Fetch the complete content index at: https://blog.fabrixly.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to Use Implicit Flow in Fabrixly-IDS - URL: https://blog.fabrixly.com/how-to-use-implicit-flow/ - Published: 2026-07-07T03:08:38.000Z - Updated: 2026-07-10T07:22:39.000Z - Author: Fabrixly - Tags: Documentation ## Overview The Implicit Flow was designed for browser-based single-page apps (SPA) that can't keep a client secret secure. It returns tokens directly from the authorization endpoint. ⚠️ **Important**: Authorization Code Flow with PKCE is now recommended instead of Implicit Flow for SPAs! But we still support it for legacy apps. ## Step 1: Configure Implicit Flow Client First, set up your OIDC client for implicit flow: ### Admin Console Setup 1. Go to **Fabrixly-IDS Admin Console** → **Clients** 2. Create or select client → click **Edit** 3. Under **OAuth/OIDC Settings**: - **Response Types**: add `id_token`, `token` (or both) - **Grant Types**: add `implicit` - **Token Endpoint Auth Method**: select `none` - **Auth Mode**: choose any auth mode you like 4. Save! ### API Setup ### Authenticating API Requests Management API endpoints (like `/api/clients`, `/api/users`, etc.) require administrative authentication. To call them: 1. **Include the Token in the Authorization Header**: Add `-H "Authorization: Bearer "` to your API calls. **Obtain an Admin JWT Token**: ```bash curl -X POST https://ids.fabrixly.com/api/auth/login \ -H "Content-Type: application/json" \ -d '{ "email": "admin@example.com", "password": "your-admin-password" }' ``` *Note: This returns a JSON response containing a `token`.* ```bash curl -X POST https://ids.fabrixly.com/api/clients \ -H "Content-Type: application/json" \ -H "Authorization: Bearer " \ -d '{ "client_name": "Implicit Flow SPA", "redirect_uris": ["http://localhost:3009/callback"], "response_types": ["id_token", "token"], "grant_types": ["implicit"], "token_endpoint_auth_method": "none", "auth_mode": "flexible" }' ``` ## Step 2: Example Implicit Flow SPA Create an HTML file `implicit-spa.html`: ```html Implicit Flow Demo

Implicit Flow Demo

``` ## Step 3: Serve the SPA Run a simple HTTP server to serve `implicit-spa.html`: ```bash npx http-server -p 3009 ``` Visit [http://localhost:3009/implicit-spa.html](http://localhost:3009/implicit-spa.html?ref=blog.fabrixly.com) to test! ## Implicit Flow Steps 1. SPA redirects user to Fabrixly-IDS authorization endpoint 2. User logs in (via any auth mode) 3. Fabrixly-IDS redirects back to SPA with `id_token` and/or `access_token` in URL hash 4. SPA parses tokens from hash 5. SPA stores tokens in sessionStorage or localStorage 6. SPA uses access token to call APIs ## Security Considerations - **Use HTTPS always**: Tokens are in URL, so HTTPS is critical! - **Short-lived tokens**: Implicit flow tokens have short expiry - **Don't store in localStorage**: Prefer sessionStorage to limit token lifetime - **Validate state and nonce**: Prevents CSRF and replay attacks - **Prefer Authorization Code Flow with PKCE**: For new apps, use PKCE instead of implicit! ## Troubleshooting - **Tokens not in URL hash**: Check client's `response_types` includes `id_token` and/or `token` - **"Invalid redirect\_uri"**: Verify redirect URI matches exactly what's in client config - **CORS errors**: Ensure your SPA domain is allowed by Fabrixly-IDS CORS settings ## Next Steps - Try Authorization Code Flow with PKCE instead! - Add token refresh using silent authentication