Skip to main content
The white-label mobile app signs customers in through Lobyco’s identity provider, Lobyco IDP. It runs in one of two modes, chosen per client. In the first, Lobyco IDP holds the customers’ credentials. In the second, Lobyco IDP hands the sign-in to your existing identity provider over OpenID Connect and keeps its own record of the customer. This page says what each mode gives you, and what the second one needs from you.

​
Lobyco IDP as the identity provider

Choose this mode when you have no membership programme with credentials yet. It also fits when your current identity solution is limiting you and you want to move away from it.
  • Lobyco IDP stores the identity: phone number, email and password.
  • Customers sign in with their phone number or their email as the username.
  • The sign-up and sign-in flow is Lobyco’s white-label flow, in the app.
  • Phone verification by SMS is supported.
  • Your existing websites can use the same identity, so customers sign up and sign in once. See Set up Lobyco IDP for your websites.

​
Lobyco IDP in front of an external identity provider

Choose this mode when you already have a membership programme with credentials, for example in Azure AD B2C, Okta or Auth0. Customers keep their current login, and nobody creates a new account.

​
What you register with your provider

Register the Lobyco IDP callback URL as an allowed redirect in your provider. The URL takes the form https://idp.your-environment.lobyco.net/signin-identity. Each environment has its own host; ask Lobyco for the exact values.

​
What Lobyco registers for you

Lobyco configures the connection to your provider in Lobyco IDP. Send Lobyco:
  • The application id, also called the client id.
  • The client secret.
  • The authorization endpoint URL.
  • The token endpoint URL.

​
How a sign-in runs

  1. The customer taps Sign in in the app.
  2. The app opens a web view and sends the browser to Lobyco IDP.
  3. Lobyco IDP sends the browser on to your identity provider.
  4. The customer signs in there.
  5. Your provider sends the browser back to Lobyco IDP.
  6. Lobyco IDP validates the response, provisions the customer in its own database and finishes the sign-in.
  7. Lobyco IDP sends the browser back to the app, which closes the web view.
Sequence diagram: the web view calls Lobyco IDP, is redirected to the external IDP where the customer authenticates, and returns to the Lobyco callback; Lobyco IDP exchanges the code for tokens, provisions the customer and redirects to the app callback The sign-in sequence between the web view, Lobyco IDP and the external identity provider Lobyco IDP keeps the key identity fields: userId, memberId, email and phone. Anything else about the customer is imported with POST /v1/members/import.

​
Azure AD B2C

To sign customers in with accounts from an Azure AD B2C tenant, create a new application in that tenant for Lobyco IDP. Microsoft’s guide: Create an Azure AD B2C application.

​
API reference

Endpoint documentation: Members.
Last modified on October 19, 2026