pingidentity

Guide for building web apps with the Ping Orchestration JavaScript SDK (also referred to as the Ping Identity JavaScript SDK, formerly the ForgeRock JavaScript SDK / @forgerock/javascript-sdk; npm packages: `@forgerock/journey-client`, `@forgerock/davinci-client`, `@forgerock/oidc-client`). Use when the user wants to add Ping authentication to a web app — phrases like "add Ping auth to my web app", "use PingOne in React", "set up Journey in JavaScript", "build a Ping login page", "use DaVinci in my SPA", "integrate @forgerock/journey-client", "set up @forgerock/davinci-client", "migrate from @forgerock/javascript-sdk to the new SDK", or "add OIDC login to my React app". Detects framework (React active; Angular, Vue, vanilla JS on the roadmap), collects shared config, delegates Journey to ping-orchestration-reactjs-journey-sdk and DaVinci to ping-orchestration-reactjs-davinci-sdk, and handles OIDC centralized login inline. Covers both new sample app creation and integrating into an existing project.

Use when building ReactJS web authentication with the Ping Orchestration JavaScript SDK (DaVinci) using `@forgerock/davinci-client` — scaffolds a complete React SPA authentication flow against PingOne DaVinci. Handles DaVinci client configuration, OIDC token exchange, dynamic DaVinci collector rendering in React (text, password, social login, MFA, FIDO2/passkeys, PingOne Protect), protected routes, user profile, and logout. Invoke when the user asks to "use @forgerock/davinci-client in React", "render DaVinci collectors in a React app", "set up PingOne DaVinci authentication in React", "build a React SPA with DaVinci", "add DaVinci login to my React app", or "use the DaVinci SDK with Vite and React". Also covers migrating a React app from `@forgerock/javascript-sdk` to `@forgerock/davinci-client`.

Use when building ReactJS web authentication with Ping Identity — scaffolds a complete React SPA authentication flow using the Ping Orchestration JavaScript SDK (`@forgerock/journey-client`, `@forgerock/oidc-client`) against PingOne Advanced Identity Cloud (AIC) or PingAM. Handles Journey client configuration, OIDC token exchange, dynamic Journey callback rendering in React, protected routes, user profile, and logout. Invoke when the user asks to "use @forgerock/journey-client in React", "render Journey callbacks in a React app", "set up Journey authentication with React and Vite", "add PingAM login to my React SPA", "integrate AIC Journey in React", or "build a React app with Ping Identity Journey". Also covers migrating a React app from `@forgerock/javascript-sdk` to `@forgerock/journey-client`.

Use when a user asks for help with Ping Identity SDK, ForgeRock SDK, or Ping Orchestration SDK integration without specifying a platform — phrases like "help me add Ping auth", "I want to use PingOne", "get started with the Ping Orchestration SDK", "add Ping login to my app", "integrate the ForgeRock SDK", "use the pingidentity SDK". Probes the project to detect Android, iOS, JavaScript, or React Native, asks if ambiguous, and routes to the matching umbrella skill (ping-orchestration-android-sdk, ping-orchestration-ios-sdk, ping-orchestration-javascript-sdk; React Native on the roadmap) or to forgerock-to-ping-journey-migration when ForgeRock SDK references are present (forgerock-android-sdk, forgerock-ios-sdk, @forgerock/javascript-sdk).

Guide for building Android apps that integrate with the Ping Orchestration Android SDK (also referred to as the Ping Identity Android SDK, formerly the ForgeRock Android SDK / forgerock-android-sdk; Gradle artifact: `com.pingidentity.sdks:android`; modules: `journey`, `davinci`, `oidc`, `fido`, `protect`, `externalidp`, `binding`, `oath`, `push`). Covers both new project scaffolding and adding the SDK to an existing app. Use this skill whenever the user is: (1) building any Android app that authenticates against PingOne, PingOne Advanced Identity Cloud (AIC), PingAM, or DaVinci using Journey, DaVinci, or OIDC flows; (2) configuring SDK modules (Journey, DaVinci, OIDC, FIDO/passkeys, Protect, ExternalIdP, OATH, Push, Device Binding); (3) rendering Journey callbacks or DaVinci collectors in Jetpack Compose; (4) troubleshooting Ping authentication flows in an Android app; (5) setting up token or session storage with `EncryptedDataStore`; (6) scaffolding a new Android/Kotlin project for a Ping-authenticated app;

Guide for building iOS apps that integrate with the Ping Orchestration iOS SDK (also referred to as the Ping Identity iOS SDK, formerly the ForgeRock iOS SDK / forgerock-ios-sdk; Swift Package: `Ping/ping-ios-sdk`; modules: `PingJourney`, `PingDavinci`, `PingOidc`, `PingExternalIdP`, `PingProtect`, `PingOath`, `PingLogger`, `PingStorage`). Use this skill whenever the user is: (1) building any iOS app that authenticates against PingOne, PingOne Advanced Identity Cloud (AIC), PingAM, or DaVinci using Journey, DaVinci, or OIDC flows; (2) configuring modules (Journey, DaVinci, OIDC, FIDO/passkeys, Protect, ExternalIdP, OATH, Push); (3) rendering Journey callbacks or DaVinci collectors in SwiftUI; (4) troubleshooting Ping authentication flows in an iOS app; (5) setting up token or session storage with `KeychainStorage`; (6) scaffolding a new Xcode project for a Ping-authenticated app; (7) applying Ping Identity branding to a sample app; (8) implementing OIDC centralized login with `OidcWebClient`, configuring `ASW

Use when migrating a project from the legacy ForgeRock SDK (FRAuth, FRSession, forgerock-ios-sdk, forgerock-android-sdk, @forgerock/javascript-sdk) to the new Ping Identity Journey SDK. Trigger whenever the user mentions migrating, upgrading, porting, or converting ForgeRock code to the Ping SDK — phrases like "ForgeRock to Ping migration", "upgrade FRAuth", "replace FRSession", "move off @forgerock/javascript-sdk", "migrate to @forgerock/journey-client", "upgrade to Ping Journey SDK", or even a vaguer "help me modernize our ForgeRock auth". Works on Android (Kotlin), iOS (Swift), and JavaScript/TypeScript codebases. Preserves old code as comments so rollback is trivial, verifies the app still builds, and writes a line-numbered report of every change.

Use when writing code or wiring an SDK to integrate Ping Identity into a web, mobile, or backend app — Android/iOS/JavaScript SDK installation, OIDC authorization code + PKCE flows, token management, ForgeRock-to-Ping SDK migration, and app-side troubleshooting (redirect_uri_mismatch, CORS, token refresh failures).

Use when setting up, configuring, or administering any Ping Identity platform — PingOne, PingOne Advanced Identity Cloud (AIC), or Ping Advanced Identity Software (PingAM, PingFederate, PingAccess, PingDirectory, PingID). Covers tenant/environment creation, app registration (including Worker apps and service accounts for M2M API access), SSO, directories, policies, branding, and CLI-driven configuration automation (pingcli, Terraform/CaC export, multi-env promotion). Requires a named or clearly implied platform.

Use when an AI agent, LLM, or agentic workflow interacts with Ping Identity — agent machine identity, client credentials for agents, Verified Trust signals, PingGateway as MCP gateway, CIBA human-in-the-loop approvals, or AI/bot detection with PingOne Protect. Ask a clarifying question before routing if 'agent' lacks AI/LLM context.

Use when designing, building, or advising on authentication flows or orchestration logic — DaVinci flows, PingOne Advanced Identity Cloud journeys, PingAM trees, login/registration/MFA/step-up/passwordless flows, scripted decision nodes, and social login. Ask one clarifying question about use case and platform before recommending journey vs DaVinci if either is unknown.

Use before any other Ping skill when the user is in orientation mode — 'where do I start', 'which Ping product do I need', 'help me choose', 'we're evaluating', 'migrating from an existing identity platform', 'inherited a Ping deployment', or when platform is unknown. Also use for bare user-management commands with no platform named ('Add a user to Ping') — clarify platform before routing.

Use when configuring or invoking a Ping shared service at the policy or service level — PingOne Protect (risk scoring), PingOne Verify (KYC/identity proofing), PingOne MFA (device management, enrollment API), PingOne Credentials (verifiable credentials), PingOne IGA, PingOne Authorize (fine-grained authorization), or PingOne Privilege (PAM). This skill owns service node configuration inside DaVinci flows and AIC journeys.

Required conventions for MCP tool implementation — structure, response formatting, annotations, and registration. TRIGGER when: creating or modifying any tool file in src/tools/; changing inputSchema, toolFunction, or response handling; adding a tool category; touching code that uses makeAuthenticatedRequest, createToolResponse, or formatSuccess. SKIP when: only modifying tests (use testing skill), only reviewing code (use review-conventions skill).

Audit and report on MCP server activity in AIC logs — authentication events, user-attributed actions, and API traffic. TRIGGER when: user asks what has been done/used/changed via the MCP server; asked to audit or review MCP activity; asked to show recent actions, operations, or usage; user wants to trace an action back to a user or session.

Code review checklists and common pitfalls for this codebase — security, correctness, conventions, and verification commands. TRIGGER when: reviewing a PR or diff; user asks to review, check, or validate changes; running /review or /security-review; verifying tool implementation correctness before committing.

Required conventions for writing and modifying tests — framework, file template, section ordering, and security test requirements. TRIGGER when: creating or modifying any file under test/; adding, changing, or removing tool parameters or response behavior that requires test updates; user asks about testing patterns or test structure.

Use this skill when answering questions about Ping CLI commands, flags, usage patterns, or when helping users construct CLI invocations. Invoke whenever the user asks about a pingcli command, wants to know available options, or needs to understand command behavior. This reference covers Ping CLI dev.

Guided workflow for generating SDKs from OpenAPI specifications. Use when users request SDK generation, build, or creation for specific products (pingone, identitycloud, etc.) and languages (go, python, etc.). Triggers on requests like "build the X SDK", "generate Y client library", "create Z API SDK", or any request to produce SDK code from OpenAPI specs.