# Services

Version: `2.9.8`

## Advanced services

These helpers are for advanced IAM flows only. They do not replace the main SSO flow.

- `mobilePasswordService`
- `profileChangeService`
- `profileMediaService`

## Password magic link

- the SaaS calls `POST /api/sso/password-link`
- the SaaS backend relays the request to IAM server-to-server
- IAM returns a `magic_token` or a ready-to-open redirect URL
- the package opens the returned URL

## Webhook reminder

- webhooks are separate from the SSO login flow
- the SaaS keeps `IAM_WEBHOOK_SECRET` locally to verify webhook signatures
- IAM uses the same secret value on the application record to sign outbound webhooks