Requires the OIDC clients feature to be enabled for your organization.

An OIDC client is an external app or service that you authorize to use Flip as its identity provider. Users sign in to that app with their Flip credentials, with no separate login required. You create and manage these clients yourself in the Admin Console, so you can enable a new connection or update an existing one without contacting support.

Common uses:

• Give employees single sign-on from Flip into a third-party or in-house web application.
• Enable login for an app you built with the Mini App Builder.

Before you begin

• You need the System Admin role. Only System Admins can view or manage OIDC clients.
• Decide on a Client ID for the client (see the create step for the naming rules).
• Have your application's redirect URI ready (the URL Flip returns users to after they sign in). You can add more than one.
• Decide whether you need a public or confidential client (see the next section).

Public vs. confidential clients

Choose the type based on whether your application can keep a secret safe.

If you are unsure, start with a public client.

Create an OIDC client

1. Go to Access & security → OIDC clients and select + Create OIDC client.
2. Enter a Client ID. Use lowercase letters, digits, and single hyphens between segments, 3 to 32 characters (for example, my-oidc-client). This identifies the client to Flip and to your application.
3. Turn on Confidential if your app runs server-side and can store a secret. A secret is generated automatically, and you can copy it after the client is created. Leave it off for a public client, which uses PKCE instead.
4. Leave PKCE on (recommended). It requires PKCE (S256) in the authorization code flow for stronger security. Turn it off only if the connected application does not support PKCE.
5. Leave Flip API access off unless the app needs to act on the user's behalf in Flip (see the section below before enabling it).
6. Optionally add a Client name, a Description, and an SSO domain. Set the SSO domain only if your organization uses Flip on more than one domain, to control which domain this integration routes its login to.
7. Choose the Access token lifespan. Use one of the preset values, or select Custom to set your own between 5 minutes and 24 hours. A shorter lifespan narrows the window in which a leaked token is usable.
8. Under Redirect URIs, select + Add URI and add each URL Flip may return users to after sign-in (see the redirect URI rules below).
9. Optionally add Logout URIs (where users are sent after signing out). If left empty, the redirect URIs are used.
10. Select Create OIDC client.

You will know it worked when the new client appears in the OIDC clients list. Open it to copy the connection details (OIDC Discovery URL, and the secret for confidential clients) into your application's configuration.

Redirect URI rules

• Prefer exact https:// URLs, and keep them as narrow as possible.
• Trailing * wildcards are supported.
• Each URI must be unique across all of your OIDC and SAML clients.
• If the client is used in Flip menu items, the menu item URL must match one of the redirect URIs so that automatic login propagation works reliably.

Allow a client to call Flip APIs

By default, an OIDC client can only sign users in. If you turn on Flip API access, the client gains the signed-in user's full permissions and can act on their behalf in the Flip app.

Enable this only when the application genuinely needs to call Flip APIs for the user. Leaving it off keeps the client limited to sign-in, which is the safer setting. The OIDC clients list shows whether API access is Active or Inactive for each client.

Find the client's connection details

Open a client to see the details your application needs:

• The OIDC Discovery URL (for example, https://your-flip-domain/auth/realms/flip/.well-known/openid-configuration). Use Copy to grab it. This one URL lets your app discover all the OIDC endpoints it needs (authorization, token, and user info).
• The Client ID you set when creating the client.
• For confidential clients, the OIDC secret.

Developers integrating Flip login into a custom app can find the full development guide at getflip.dev.

Manage a confidential client's secret

Confidential clients have an OIDC secret in addition to the Client ID. In the client's details view, under OIDC secret:

• Copy the secret into your application's configuration. Treat it like a password.
• Rotate secret value when you need to replace it, for example if it may have been exposed.

Rotating breaks existing integrations. All integrations still using the current secret will no longer be able to obtain new access tokens. Update your application with the new secret immediately after rotating.

Edit or delete a client

• Edit: open the client (or select Edit in the list) and change its name, description, redirect URIs, or settings, then save.
• Delete: removing a client immediately stops it from being able to sign users in. Make sure no live application still depends on it before you delete.

Troubleshooting

• Login fails with a redirect URI error: the URL your app sent does not match a redirect URI on the client. Add the exact URL, or use a trailing * wildcard, and make sure it is unique across your OIDC and SAML clients.
• Login fails and the app cannot use PKCE: confirm whether the app supports PKCE. If it genuinely cannot, turn off PKCE on the client.
• API calls are rejected: check that Flip API access is set to Active on the client.
• Login stops working after rotating the secret: the app is still using the old secret. Update it with the current secret from the details view.
• Login routes to the wrong domain: if your organization uses Flip on more than one domain, set the client's SSO domain.