DATA ORCHESTRATION
Capabilities
Authentication & identity
Every request into Flybits is authenticated as someone — an end user in your app, or a service in your estate. Identity comes from your identity provider; Flybits never becomes a second source of truth for who the customer is.
Authentication is handled per environment and per surface. Development flows exist so teams can build without production credentials, and production flows are signed by keys you hold.
YOUR IDP → SIGNED LOGIN → SCOPED SESSION
Your IdP▸JWT signed login▸User session
SSO / OIDC▸OpenID Connect▸Scoped token
Your backend▸Service account▸Server session
WHAT IT DOES
Signed login
Your backend signs an assertion about the user with a key pair you control. Flybits validates the signature and issues a scoped session, so credentials never pass through the platform.
Standards-based SSO
OpenID Connect and SAML flows let Flybits sit behind the identity provider you already run, including step-up and session lifetime rules enforced on your side.
Service accounts
Server-side work — context reporting, content management, orchestration calls — runs under a service account with its own scopes and rotation, separate from user sessions.
Recoverable session state
The SDKs surface invalid or expired session state through delegates and broadcasts so the host app can re-authenticate silently instead of failing the screen.
IN DETAIL
—
Development authentication lets app teams work against a non-production environment before signing is wired up.
—
Production flows use JWT signed login, OpenID Connect or SAML depending on the surface and the identity provider.
—
Service accounts carry their own scopes for context reporting, content management and orchestration calls.
—
Invalid session state is surfaced to the host app — delegates on iOS, broadcasts on Android — so it can recover silently.
SERVICES & BUILDING BLOCKS
JWT SIGNED LOGIN
Key-pair signed assertion from your backend, exchanged for a scoped Flybits session.
OPENID CONNECT
Token exchange against your OIDC provider for app and web sessions.
SAML LOGIN
Enterprise SSO for administrative and workforce access.
SERVICE ACCOUNT APIS
Machine identities for server-side reporting, content and orchestration calls.
SESSION RECOVERY
Delegate and broadcast hooks for invalid-state handling in the SDKs.
ENVIRONMENTS
Separate credentials and endpoints per environment, so keys never cross deployments.