nClarity, multi-tenant IoT analytics SaaS platform

Identity and access modernization, end to end

role: Owned identity for the platform; designed and built it end to end.

// problem

The platform served many customer organizations, internal staff and a mobile app, each with different access needs. Support relied on shared accounts.

// approach

Customer identity (CIAM) with MFA and account recovery.
Staff SSO over OIDC with group-based access and just-in-time provisioning.
OAuth authorization code + PKCE for the mobile app.
A delegated-access model that retired shared support accounts.
Role-based access control and organization policies across customer accounts.

// architecture

Customers

Staff

Mobile app

CIAM

MFA, recovery

SSO

OIDC, JIT

Auth code

PKCE

Platform API

RBAC, org policies

Delegated access

for support

Customers, staff and the mobile app each authenticate through their own flow: CIAM with MFA, SSO over OIDC, and authorization code with PKCE. All three reach the platform API, which enforces RBAC and organization policies. Support uses delegated access instead of shared accounts.

// guardrails and production concerns

No shared credentials for support staff.
PKCE instead of client secrets on mobile.
Group-based access for staff, provisioned just in time.

// outcome

One identity model across customers, staff and mobile. Shared support accounts were retired in favour of delegated access.

// stack

OAuth 2.0
OIDC
PKCE
SSO
RBAC
Node.js
TypeScript