OIDC Client Direct Calls

Client Direct Calls let a Flow client call a backend HTTP system directly, bypassing the Connector Agent. Instead of routing every request through the agent, the client obtains an OpenID Connect token and talks to the backend endpoint itself.

This reduces latency and removes the agent as an intermediary for those calls — useful when the client already has a network path to the backend (for example a mobile app calling IFS Cloud).

Direct Calls are an optimization, not a replacement for the Connector Agent. Steps that don't meet the requirements below continue to run through the agent as normal.

How it works

Normally a client sends its request to the Connector Agent, which authenticates and forwards it to the backend system. With Client Direct Calls, the client authenticates against the OpenID provider, receives a token, and sends the request straight to the backend HTTP endpoint — the Connector Agent is not in the call path.

Standard:      Client → Connector Agent → Backend system
Direct Calls:  Client ────────────────→ Backend system

Requirements

For Client Direct Calls to work, all of the following must be true:

• The client must have direct network access to the backend system. Either the client is on the same network as the system, or the system is publicly reachable. If the client cannot reach the endpoint directly, the call cannot bypass the agent.

• The endpoint must be an HTTP endpoint configured for OpenID (OIDC) authentication. Direct Calls only work with HTTP endpoints that authenticate via OpenID Connect.

• The OpenID provider's .well-known configuration must be accessible to the client. The client relies on the provider's discovery document to obtain and validate tokens.

Limitations

Web Client depends on the browser's CORS policy. Because the Web Client runs in a browser, direct cross-origin calls are subject to the browser's CORS rules — this is a browser behaviour, not a limitation of the Flow Web Client itself. If you control the backend, you can often make it work by configuring the system to allow the required cross-origin requests (CORS). Otherwise, route the call through a proxy or let it fall back to the Connector Agent.

• OpenID only. Endpoints using other authentication methods (Basic, API key, etc.) are not eligible for Direct Calls and continue to go through the Connector Agent.

• HTTP only. The feature applies to HTTP endpoints; other connector types are unaffected.

When to use it

Use Client Direct Calls when the client has a direct path to a backend system exposed over HTTP with OpenID authentication — for example calling IFS Cloud directly from a mobile device. This works out of the box on the mobile clients (Android and iOS); for the browser-based Web Client it depends on the backend's CORS policy (see Limitations). For endpoints that aren't OpenID-secured, keep using the Connector Agent.