Identity Service

The Identity Service signs users in and manages what they can do in each environment.

• Sign-in: users sign in to the Management System with the identity providers configured for the environment, such as email and password, Google, Microsoft Entra ID or any OpenID Connect provider.
• Access management: users, user roles and their permissions, service accounts and OAuth clients of each environment.
• Access tokens: the Identity Service issues the access tokens that all Mosaic services accept, signed with the keys of the environment.
• OAuth 2.1 authorization server: AI agents, command-line tools, native apps and integration tools sign users in with OAuth and get access tokens limited to the permissions the users grant them. Service accounts get access tokens with the standard client credentials grant.

See also:

• Configure Identity Providers
• Authenticate Service Account
• OAuth 2.1 Authorization Server
• Manage OAuth Clients
• Mosaic MCP Server
• Authentication and Authorization