Launch customer identity
Give each B2B customer a clear tenant boundary for members, SSO, provisioning and tenant-level policy.
Explore customer identityB2B SaaS identity, access and operations
Give every identity a clear path from sign-in to access decision.
Bring customer, workforce and service identities into one connected model. Keep tenant boundaries clear, enforce permissions where resources are protected, and make important changes reviewable through an audit trail.
A connected model for customer, workforce and service identities—with policy boundaries that remain explicit.
OpenID ConnectOAuth 2.1 + PKCESAML 2.0SCIM 2.0PasskeysTOTP
Illustrative workflow based on the documented product model—not a live console screenshot. Exact behavior depends on configuration.
Start with the job to be done
Choose the identity workflow you need to improve.
Explore WebFrolic through the work your team is responsible for. Each path connects the relevant identity boundary, access controls and operational capabilities.
Manage workforce access
Connect employee identity, self-service, lifecycle changes and role-aware access.
Explore workforce identityControl privileged and delegated access
Make resources, permissions, API credentials and access decisions explicit.
Explore authorizationRun identity operations
Support account changes, service requests and repeatable workflows with clear ownership.
Explore operationsSee the model at work
Follow the identity decision—not just the login.
Choose a common situation to see the identity context, the controls involved and the evidence you should expect to review. These are explanatory workflows based on the documented product model; they are not a live product simulation.
Scenario 01
One person. A different level of responsibility.
A customer joins the company as an employee. The identity classification needs to reflect the new relationship, with employee-specific controls rather than leaving elevated access on a customer identity.
What to verify: segment assignment, profile requirements, authenticator assurance, network and session policy, and audit context.
01Identify the account and its segmentCustomer is the default segment; employee status can be assigned through configured creation, signup-domain rules or the employee group.
02Apply the employee policy setSegment-specific authenticators, roles, groups, profile attributes, network rules and dashboards can be configured.
03Retain a useful recordAudit records include user, session and device information so investigators can reconstruct actions.
Scenario 02
Let each tenant administer its own boundary.
A B2B customer needs to manage its members and enterprise integration while the platform owner retains control of global identity policy.
What to verify: tenant roles and scopes, member and group management, SAML/OAuth2 setup, SCIM configuration and tenant-level network and assurance requirements.
01Establish the tenant boundaryTenant-level roles govern which administrative resources a tenant member can manage.
02Configure members and integrationTenant administrators can manage members, groups, domains, SAML/OAuth2 authenticators and SCIM settings according to assigned permissions.
03Evaluate tenant-specific controlsNetwork filters and authenticator assurance requirements can be configured for tenant members.
Scenario 03
Support the real account owner through recovery.
Recovery is a sensitive identity operation. The product design limits what support staff can do and gives administrators controls over recovery requirements and the aftermath.
What to verify: recovery credential rules, user notifications, account lock policy, credential invalidation and API-key revocation after recovery.
01Use a designated recovery pathRecovery is treated as its own ceremony rather than reusing the ordinary enrollment or password-change path.
02Keep support assistance constrainedBy design, support staff can help enroll a recovery credential; they do not directly replace the user's existing authentication credentials.
03Apply configured recovery safeguardsOptions include required assurance, credential deletion, a post-recovery lock period and revocation of the user's API keys.
Explore the supporting material: Product guide → Console documentation → API reference →
Security you can inspect
Show the design decisions behind the promise.
Identity security is made of edge cases and transitions. WebFrolic's design focuses on controls that should be visible, testable and auditable—not merely listed on a page.
Server-side flow state
Signup, authentication, enrollment, recovery and authorization steps are modeled with server-side state and validation rules for allowed transitions.
Read the design →Policy at several boundaries
Rate limits can be set by user, session, tenant, IP address and operation. Network controls can apply to roles, identities, tenants, integrations, apps, service accounts and API keys.
Review the controls →An audit trail built in
Actions on resources are captured with user, session and device context. End users and administrators can also see and control sessions and API keys.
See the principles →OIDC authenticationOAuth 2.1 authorizationPKCE requiredSAML 2.0 SSOSCIM provisioningWebAuthn / passkeysConfigurable AAL requirements
Common questions
Start with the details that matter.
Who is WebFrolic designed for?
The initial story is especially relevant to B2B software companies managing tenant members, customer identities, employee access and support operations. The product also documents customer, employee, administrator, tenant-administrator, support, auditor, service and machine identity models.
Which identity standards are supported?
The product documentation describes OpenID Connect for authentication, OAuth 2.1 for authentication and authorization use cases, SAML 2.0 and SCIM provisioning. OAuth 2.1 requires PKCE for authorization-code flows, and the same requirement applies to OIDC. Review the API reference and product documentation for scope and operations.
How should we evaluate security claims?
Start with the product guide and architecture explanations, then ask for a walkthrough of the exact policy and recovery paths you need. We do not publish invented customer results or claim certifications that are not documented.
Talk through your architecture
Bring us the identity problem you're trying to remove.
Tell us what you use today for customer sign-in, workforce access, tenant administration or support workflows. We'll work through the fit with you, including the parts that need a closer technical look.