Sign-in for your app
Every tenant has a directory: users, how they sign in, and two-factor rules. An app you run on the platform can sign people in with it over OpenID Connect, the same way it would use Entra ID, Okta, or Google.
1. Register the app
Section titled “1. Register the app”In the console, open IAM → App registrations → New application.
| Field | What to enter |
|---|---|
| Kind | Sign people in (OpenID Connect) |
| Name | Shown on the sign-in page, for example Shop |
| Who can sign in | This tenant keeps users in your directory. Any tenant lets people from every tenant sign in at their own tenant, like a multi-tenant app in Entra |
| Redirect URIs | Your app’s callback, one per line, for example https://shop.m12p.com/api/v1/auth/callback. Exact match |
| Public client | On only for browser or mobile apps that cannot keep a secret. PKCE is required then |
With This tenant, Also accept adds guests: people from other tenants, or from Google, GitHub, or Microsoft. Sign-in policy for this app can require other methods or two-factor for this app only.
The console shows the client secret once. Copy it straight into the service’s environment.
2. Set the environment
Section titled “2. Set the environment”On the service’s Environment tab:
| Name | Value |
|---|---|
IAM_ISSUER | https://api.m12p.com/iam/<tenant id>. With Any tenant: https://api.m12p.com/iam/common |
IAM_CLIENT_ID | The client id, client_... |
IAM_CLIENT_SECRET | The secret from step 1 |
IAM_REDIRECT_URL | The redirect URI your app sends |
The names are a convention. Use whatever your OpenID Connect library reads. Deploy after changing the environment.
The issuer uses the tenant id, not its name. Renaming the tenant does not break sign-in.
3. What the app talks to
Section titled “3. What the app talks to”Point your library at the issuer. It finds everything else in
<issuer>/.well-known/openid-configuration:
| Endpoint | Path |
|---|---|
| Authorize | <issuer>/authorize |
| Token | <issuer>/token |
| User info | <issuer>/userinfo |
| Signing keys | <issuer>/jwks |
| Sign out | <issuer>/logout |
| Revoke | <issuer>/revoke |
The flow is the authorization code flow with PKCE (S256). Scopes are
openid, profile, email, and offline_access for a refresh token. ID
tokens are signed with RS256. Besides the standard claims they carry tid
(the tenant the user signed in at), roles, and permissions from the
tenant’s directory.
Moving to another domain
Section titled “Moving to another domain”Add the new callback to Redirect URIs before you move the app, and keep
the old one until the move is done. Then point IAM_REDIRECT_URL at the new
callback, deploy, and remove the old URI.
This secret only signs people in. It cannot call the platform API. For automation, use a service principal.