Configure managed identity

Managed identity separates the application’s production sign-in environment from Agent and service credentials.

Production domain lifecycle

1. POST /v1/applications/{appId}/identity/production prepares the customer-owned domain.
2. POST /v1/applications/{appId}/identity/production/check checks DNS and certificate state.
3. POST /v1/applications/{appId}/identity/production/activate switches managed login only after verification.

Each write carries a stable idempotencyKey. Creating the production instance and enabling usage-billed authentication also require billingAcknowledged where the schema says so.

Authentication methods

• PUT /identity/phone-authentication enables or disables usage-based SMS authentication.
• PUT /identity/enterprise-connections/{connectionId} creates or updates an OIDC or SAML connection.
• POST /identity/enterprise-connections/{connectionId}/test creates a short-lived test link.
• DELETE /identity/enterprise-connections/{connectionId} removes the production connection.

Boundaries

Identity configuration never returns a client secret. Domain activation does not grant an Agent access to application operations, and application Agent keys do not administer identity.

See also

• Application model
• Authentication matrix