OW Docs
Guides
Set up sign-in, clients and identity providers in Access, and build journeys in Identity Orchestration.
Sign-in and Access
How sign-in works
Follow a sign-in from your app through Access and an Identity Orchestration journey and back. Learn which endpoints your app calls, what the session and tokens are, and how logout works.
Web clients and API clients in Access
Register an app that signs users in, a backend that calls the platform's service APIs, and a pipeline that configures Access itself. Each needs a different kind of client.
Scopes and claims
Decide what apps may ask for and what user data ends up in their tokens. Create scopes, map Identity Store attributes to claims, and assign scopes to clients.
External identity providers
Let users sign in with Google, Apple, Microsoft Entra ID, any SAML or OpenID Connect provider, or a national eID. Connect the provider once in the Identity Broker, use it from any app, and test it before go-live.
Administrators and their rights
Invite people to the admin consoles, give each one only the rights they need per tenant, and remove them when they leave.
Identity Orchestration
Build your first journey in Identity Orchestration
Build a username and password login flow in the IO flow designer, test it from its flow URL, and activate it. Along the way you learn the parts of IO you use every day.
Flows and nodes
How IO flows are organised (types, categories, defaults, versions and library flows), how a journey is started, and which node to use for each job: pages, API calls, scripts, conditions, loops and Thales service nodes.
Vaults: secrets and environment settings
Keep client secrets, API keys, hosts and client IDs out of your flows. Store them in vaults, read them at run time with Load From Vault, and the same flow runs unchanged on every environment.
IO best practices
Design rules that keep IO journeys secure, fast and easy to change: one flow type per journey, every output connected, secrets in vaults, cached tokens, clean variables, useful logs and safe releases.
Troubleshooting IO
Find out why a journey fails, hangs, shows the wrong value or can't be found, and fix it. Covers the common error messages, reloads, variables, vaults, API calls and Thales service nodes.