WebFrolic, with its beaver mascot in a W cap

WebFrolic, in plain words

One place that holds every person who signs in to anything you run — staff, customers, partners and machines — and decides what each of them may reach.

Most organisations end up with a password list per system. Someone joins and you set them up five times. Someone leaves and you hope five people remember to remove them. WebFrolic replaces that with a single office: it holds the people and the roles, and your systems ask it who this is.

What it removes

A separate account and password per system
Spreadsheets of who has access to what
Leavers still logged in somewhere on a Friday
Access requests arriving by email

What it gives you

One sign-in, with passkeys or a second factor
Access decided by a person's role, not by memory
Removing access once, everywhere
A record of who did what, and when

How to read this guide Every instruction comes with a grey path strip showing exactly where to click. Follow it from the dashboard named first.

Go to Administrator → Configuration → Settings → General

That strip means: open the Administrator dashboard, click Configuration in the left menu, choose Settings, then the General tab.

The four dashboards

Everyone signs in once. What they see afterwards depends on the roles they hold. A person can hold several and switch between them.

Dashboard	Who gets it	What they do there
My account	Everyone	Their own profile, sign-in methods, contact details, sessions and support tickets
Administrator	Your IT or identity team	Runs everything: people, roles, applications, security, automation
Employee	Staff	Request access, approve others, find colleagues, raise IT tickets
Help desk	Support and IT desk agents	Work ticket queues for staff and for customers

Someone holding roles in more than one place is asked which one they are acting as, and can change it later.

Go to Any dashboard → Switch Role (top of the page)

Which scope is yours

Most organisations use WebFrolic for one or two of these. Find yours, then read the industry section that fits.

Scope	The people	What matters most	Start with
Your workforce	Staff and contractors	Fast onboarding, instant removal when someone leaves, access requests with approval	Users, Groups, Authorization
Your customers	The public signing up to your product	Easy sign-up, self-service recovery, protection against bulk attacks	Settings → General, Authenticators
Business customers	Organisations who each have many users	Keeping each customer's data and admins apart	Settings → Tenancy
Machines	Your own services and integrations	Short-lived keys with narrow permissions instead of shared passwords	Applications → M2M, Authorization → Scopes

You can mix them A software company typically runs all four at once: staff on the workforce side, customer organisations as tenants, and its own services as machines.

Software you sell

You sell to other organisations. Each customer has its own users, and often its own administrator who should manage their people without seeing anyone else's.

What this looks like in WebFrolic

Each customer organisation becomes a tenant. You decide what tenants may do for themselves: manage their own groups, verify their email domains, set their own network rules.

Set it up Administrator → Configuration → Settings → Tenancy

You can rename the word "tenant" to whatever your customers are called. Set it to "Account" and the whole console says Accounts.

Typical use cases

Customer self-administration

Give one person at each customer a tenant administrator role. They add and remove their own colleagues; you never touch it.

Go to Administrator → Tenants → pick one → Role Assignment

Automatic joining by email domain

Anyone signing up with an address on a verified domain joins that customer automatically, with no invitation.

Go to Settings → Tenancy → Verified domains

Seat-based billing

Charge per assigned seat, with a limit so the bill cannot grow without someone deciding to raise it.

Go to Applications → your app → Subscription

Enterprise sign-in and provisioning

A large customer wants their own identity system to feed users in. Connect it, and their joiners and leavers flow through automatically.

Go to Applications → your app → SCIM

Decide tenancy early Turning tenancy on is easy. Turning it off after people belong to tenants leaves their membership meaningless. Decide before you onboard real customers.

Healthcare

Clinical staff move between sites and shifts, agency staff come and go, and every look at a patient record has to be attributable to a named person.

Typical use cases

Shared devices, named people

A ward terminal is used by many. Passkeys or a code on a phone keep sign-in quick without a shared password, and the audit log still names the individual.

Go to Administrator → Authenticators

Short sessions on clinical systems

Set a short session so a walked-away terminal does not stay open. Office staff can have a longer one.

Go to Settings → Session

Agency staff with an end date

Add someone to a group until a set date. They are removed automatically when the placement ends, whether or not anyone remembers.

Go to Groups → pick one → Members → Temporary assignment

Proving who saw what

Every sign-in and change is recorded with the person, the address and the time.

Go to Administrator → Logs → Transaction

Re-accepting policies When a policy changes, raise its required version and everyone is asked to accept at their next sign-in. Nobody is locked out.

Go to Settings → Lifecycle

Financial services

Strong sign-in for anything that touches money, tight control of administrators, and a trail an auditor can follow.

Typical use cases

Stronger proof for risky actions

Everyday work uses an ordinary sign-in. Payment approval or administration demands a passkey or second factor at that moment.

Go to Settings → Session (assurance level)

Office networks only

Allow administrator sign-in from your offices and VPN, and deny everywhere else.

Go to Administrator → Security → Network Firewall

Slowing down attacks

Repeated failures lock an account for review, and you can see and release those locks.

Go to Security → Friction Locks

Four eyes on access

Access to a sensitive system routes through an approval before it is granted — no access by email request.

Go to Administrator → Automation → Workflows

Recovery is the back door Strong sign-in is undone by weak recovery. Set a delay period and a review lock for administrator accounts so a stolen mailbox cannot quietly reset one.

Go to Settings → Account Recovery

Retail and e-commerce

Large numbers of customers who sign in rarely, plus store and warehouse staff who need quick access on shared devices.

Typical use cases

Sign-up that does not lose people

Choose open sign-up, invitation only, or restricted to approved email domains. Add your terms and privacy links so they appear on the sign-up screen.

Go to Settings → General

Passwordless for shoppers

A code by email or SMS, or a passkey, avoids the forgotten-password support load that comes with rare sign-ins.

Go to Administrator → Authenticators

Seasonal staff

Hire fifty people for a season into a group that grants exactly what the role needs, and ends on a date.

Go to Groups → Create

Customer support that can act

An agent working a ticket can issue a one-time code to a locked-out customer, with a note recorded for compliance.

Go to Help desk → Customer Support → a ticket

Test without sending real messages Add a test email domain or phone number, then read the code that would have been sent. No mail provider needed while you build.

Go to Configuration → Email Settings → OTP lookup

Education

Everyone arrives in September and leaves in June, in their thousands, and the same person may be a student, a tutor and a parent.

Typical use cases

Enrolment at scale

Feed students in from your student record system rather than creating them by hand. Accounts exist before anyone first signs in.

Go to Applications → your app → SCIM

One person, several roles

A postgraduate who also teaches holds both roles and picks which they are acting as.

Go to Authorization → Roles

Access by course group

Rules put people in groups automatically from their profile, so joining a course grants its systems.

Go to Automation → Rules

Graduation

Leavers are switched off in one place and lose access to every connected system at once.

Go to Users → a person → Disable

Manufacturing and field work

People on a factory floor or at a customer site, often on shared or company-owned hardware, sometimes with no desk at all.

Typical use cases

Company hardware, tracked

Record each laptop, handheld or security key, who holds it now, and who held it before.

Go to Administrator → Devices → Managed devices

Personal phones for sign-in

Field staff register their own phone as a sign-in method without it becoming company-managed hardware.

Go to Devices → Personal devices

Shared operational accounts

A line account that several people act as, with everything they do recorded against the person, not the account.

Go to Employee → Service User

Machines that talk to your systems

A production line reporting into your systems gets a short-lived key with only the permissions it needs.

Go to Applications → Add new application → M2M

Someone joins

The whole point is doing this once.

Create the person. Choose whether to send an invitation — if you do, they set their own password or passkey and you never handle it.
Go to Administrator → Users → Add user
Put them in the right groups. Groups are how access scales. One group for a team, one for a system — not one per person.
Go to Groups → pick one → Members
Check what that gave them. The person's own page lists the roles, groups and applications they now hold.
Go to Users → the person → Entitlements

The shortcut most people miss If your HR or student system can push people over SCIM, you skip step 1 and 2 entirely: joiners appear, movers change group, leavers switch off, with nobody clicking anything.

Someone leaves

This is the step that goes wrong in organisations without a single identity system. Here it is one action.

Switch the account off. They lose access to every connected system, not just this one.
Go to Users → the person → Disable
End their sessions. Disabling stops new sign-ins; ending sessions removes any that are already open.
Go to Users → the person → Sessions
Collect the hardware. Mark their laptop or key as unassigned so it can be given to someone else.
Go to Devices → the device → Assignment history

Disable rather than delete A disabled account keeps their history, so their tickets and audit trail still have a real owner. Deleting loses that.

Granting access

Access can be given directly, or asked for and approved. The second scales better and leaves a reason on the record.

Giving it directly

Go to Authorization → Roles → a role → Assignments

Letting people ask for it

Make the thing discoverable, so it appears in the staff catalogue.
Go to the role, group or application → Access → Enable discovery
Attach an approval workflow, so requests reach the right person.
Go to Automation → Workflows
Staff request it themselves, with a business reason and a duration.
They go to Employee → Self Service → Resource Catalogue

Discovery without a workflow If something is discoverable but has no approval flow, requests are accepted and then sit with nobody. Set both together.

Protecting administrators

Administrator accounts are the ones worth attacking. Four settings, in order of value.

Do this	Where	Why it matters
Require a second factor or passkey	Settings → Session	A stolen password alone reaches nothing
Shorten the admin session	Settings → Session	An open laptop is not an open console all day
Restrict sign-in to your networks	Security → Network Firewall	Credentials are useless from elsewhere
Harden recovery for admins	Settings → Account Recovery	Closes the way round all of the above

Keep a way back in Before tightening, make sure a second administrator exists and can sign in. Test with that account before you lock the first one down.

Connecting an application

Any system your people sign in to can use WebFrolic instead of its own passwords.

Create the application and choose its type. If it has a server, choose the server flow; a mobile or single-page app uses the client flow; a service with no user at all uses M2M.
Go to Applications → Add new application
Add its return address under Redirect URLs. This is matched exactly — a trailing slash or http instead of https is a different address and will fail.
Go to the application → Redirect URLs
Decide what it learns about people. Turn on role, group and tenant, and map any profile fields it needs.
Go to the application → Claims
Assign who may use it. Until you do, nobody can sign in to it.
Go to the application → Assignments

When sign-in fails Look at Administrator → Logs → Errors first. It shows the refusal from WebFrolic's side with the session and address, which is usually faster than reading the application's own logs.

Helping someone locked out

Three routes, from least to most involved.

They help themselves

Point them at the sign-in page and the recovery link. What it asks of them is set by your recovery rules.

Rules at Settings → Account Recovery

An agent issues a code

Working their ticket, an agent can generate a one-time code and read it to them, recording a note.

Go to Help desk → a ticket → Enrol recovery credential

An administrator does it

The same action from the person's own record, for cases without a ticket.

Go to Users → the person → Credentials → Add New

Check who you are talking to Each of these hands someone a working way into an account. The compliance note is what an auditor reads afterwards — write who asked and how you confirmed it was them.

Example: a B2B software company

Forty staff, three hundred customer organisations, one product. Here is the order they set things up in.

Decide who can sign up. Invitation only for staff; open sign-up for customers. Settings → General
Turn on tenancy and call tenants "Accounts" to match their own language. Settings → Tenancy
Create roles: Support agent, Engineer, Account admin. Authorization → Roles
Connect the product as an application and assign staff to it. Applications
Give each customer an Account admin, so they manage their own people. Tenants → Role Assignment
Put the support queue in WebFrolic, with a category per request type. Help desk → Categories
Require a passkey for staff administrators. Settings → Session

What changed for them Onboarding a customer went from a checklist across three systems to creating a tenant and naming its administrator. Offboarding a staff member became one click.

Example: a clinic group

Six sites, two hundred clinical staff, heavy use of agency cover and shared ward terminals.

Passkeys and phone codes for sign-in, so no shared passwords on ward machines. Authenticators
Short clinical sessions, longer for back-office staff. Settings → Session
A group per site and per speciality, granting the systems each needs. Groups
Agency staff added with an end date on their group membership. Groups → Members
Policy re-acceptance each time the information-governance policy changes. Settings → Lifecycle
Transaction log reviewed monthly for unusual access. Logs → Transaction

What changed for them Agency access now ends itself. Before, it ended when someone remembered.

Example: an online shop

Half a million customer accounts, forty head-office staff, two hundred seasonal workers each winter.

Open sign-up with email codes, so rare shoppers never face a forgotten password. Settings → General
Rate limits and friction locks against credential stuffing. Security
Customer support desk with categories for orders, returns and account access. Help desk → Categories
Agents can issue recovery codes from a ticket, with a note. Help desk → a ticket
Seasonal staff in a dated group that expires after the season. Groups
Warehouse systems get machine keys rather than a shared login. Applications → M2M

What changed for them Account-access tickets stopped reaching engineering. Agents resolve them inside the ticket they are already reading.

Where everything lives

The Administrator dashboard, in menu order. Use this when you know what you want but not where it is.

Menu	Holds	You go here to
Configuration	Settings, Branding, Email, SMS, Webhooks, Well-Known, Features	Change how sign-in, messaging and the whole platform behave
Settings (inside Configuration)	General, Advanced, Lifecycle, Tenancy, Security, Session, Account Recovery	The seven tabs that decide sign-up, sessions, tenancy and recovery
Users	Customers, employees, invitations	Add, find, disable a person; manage their credentials
Groups	Groups and their members	Grant access to many people at once
Tenants	Customer organisations	Manage a business customer and its administrators
Devices	Managed, personal, SKU directory	Track company hardware and its assignment
Authorization	Roles, Scopes, Resources	Define what may be done, and bundle it into roles
Authenticators	Password, passkey, OTP, security key, federated	Choose how people prove who they are
Applications	OIDC, SAML, OAuth2, M2M	Connect a system to WebFrolic sign-in
Automation	Workflows, events, rules, assignments	Approvals and automatic group membership
Vault	Secrets	Hold credentials your systems need
Variables	Named values	Shared settings readable across the platform
API Keys	Keys for your integrations	Let your own code call the platform
Security	Network Firewall, Custom Rate Limit, Friction Locks, JWK Keys	Restrict networks, slow abuse, rotate signing keys
Logs	Errors, Webhook, Transaction	Find out what actually happened

Words explained

Word	What it means here
Tenant	One customer organisation, with its own people kept apart from every other. You can rename the word.
Role	A named bundle of permissions. "Support agent" rather than a list of individual rights.
Resource	A thing access is granted over — a system, a record type, a queue.
Scope	What an application asks to know or do when someone signs in to it.
Assignment	Giving a role or group to a person directly, optionally until a date.
Discovery	Whether something appears in the staff catalogue to be requested.
Authenticator	A way of proving who you are: password, passkey, code, security key.
Assurance level	How strongly someone proved it. Used to demand more for sensitive pages.
SCIM	A standard way for another system to create and remove accounts automatically.
Webhook	A message WebFrolic sends your systems the moment something changes.
M2M	Machine to machine: a service signing in as itself, with no person involved.
Friction lock	A hold placed on an account after repeated failures, releasable by an administrator.

Paths in this guide follow the Administrator dashboard menu. Wording may differ slightly on your instance — tenants may be called something else, and menu items depend on which features your organisation has enabled.