[Dilusha-Madushan]

Purpose

This PR adds ThunderID Manage at b2b/manage, a React sample that shows how to build an admin app with the ThunderID SDK. The first version lets administrators list, create, and delete agents.

The main example is agent creation. The app starts the server's onboarding flow, and the SDK renders the steps returned by the server: choosing an owner, entering agent details, and viewing the generated credentials. The owner picker loads the first 30 users when it renders and lists a Load more option for the rest. The client secret starts hidden in a read-only password field, with an eye button to reveal it and a Copy icon inside the field that copies the original value.

Approach

The server defines the onboarding steps, and the SDK handles their rendering and state. The sample provides the surrounding pages, authenticated requests, and two custom flow renderers.

• Onboarding through BaseInviteUser. The app supplies callbacks that execute the flow and SDK hooks that load users, authentication flows, and user types. The current onboarding example uses the user picker; it does not demonstrate AuthFlowSelect or UserTypeSelect. After completion, the administrator can return to the list or start another agent.
• Custom rendering where needed. Two custom renderers provide the organization unit dropdown (OU_SELECT) and position the step's action button on the right. The SDK renders the remaining supported components.
• Flow lookup by handle. Configuration names the onboarding flow by handle, with default-agent-onboarding-flow as the default. The app searches the administration flows for that handle and passes the matching ID to /flow/execute. A missing flow produces a message explaining which setting to change.
• Authentication and permissions. Agent routes require sign-in. The app requests openid profile system scopes and the configured management resource, then uses the SDK's authenticated HTTP client for API calls. The server checks management permissions, and the page displays an error if a request fails.
• Agent list and deletion. The list shows 10 agents per page, with Previous and Next controls, loading placeholders, and an empty state. Deletion requires confirmation and refreshes the list. Deleting the last item on a later page returns the administrator to the previous page.
• Configuration. .env.example documents the server URL, client ID, onboarding flow handle, and management resource. The flow handle and resource have defaults. A notice appears when the server URL or client ID is missing, and .env is ignored by Git.

Related Issues

• Support the USER_SELECT Input Type for Selecting a User in a Flow thunderid#5414

Related PRs

• Implement USER_SELECT, AUTH_FLOW_SELECT and USER_TYPE_SELECT inputs in the JavaScript core and React SDK javascript-sdks#106

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[Dilusha-Madushan]

Screen.Recording.2026-10-16.at.15.41.03.mov