Solidlio Mobile

What it is

Solidlio Mobile is an iOS and Android app that runs the same three portals as the web product — MSP, Organization and Customer — against the same API. A technician works tickets, logs time, scans assets and clears approvals from a phone; an end user raises tickets, reads knowledge articles, reviews quotes and tracks deliveries.

Shipping status

Read this before you promise anything to a customer.

Concepts

Roles and permissions

The selected role view is a presentation ceiling: it removes higher-role menus and actions when an administrator wants to work as a technician or end user, but it cannot elevate a lower-role membership. Switching organization or portal remints the server session and clears cached tenant data.

Two of those rows are worth reading twice.

Reports are guarded by a role SET, not a floor. MSP technician ranks above organization administrator in the linear hierarchy, so a requireMinRole("MSP technician") floor would refuse every organization administrator on their own account’s reports. The app mirrors both, so a technician is never shown a Revenue button that is going to 403.

The Organization portal is not the Customer portal. A person whose only membership is CUSTOMER gets the Customer portal and nothing else.

Walkthroughs

Sign in

1. Open the app. If a previous session is stored and you enabled device biometrics, a Sign in with Face ID (or Touch ID) button appears above the sign-in options.
2. Otherwise, enter your email and tap Continue. The app asks the server which sign-in methods and single sign-on providers serve your email domain.
3. If the domain requires one SSO provider, the app opens it directly. If several providers are configured, choose one. Otherwise, enter your password, request a magic link, or use any optional SSO provider shown.
4. After authentication, the app derives Staff, Organization and Customer access from your memberships. If you have more than one workspace or portal, choose one on the selection screen; your choice is remembered.

If your organization enforces SSO, a password attempt is refused with a message naming the providers that will work, and those buttons appear — including when your email domain is not one of the organization’s verified domains, which is the case domain discovery cannot cover.

If your account requires multi-factor authentication, the app opens its MFA screen. Enter the current six-digit authenticator code or a recovery code. If MFA setup is mandatory, scan the QR code, save the recovery codes, confirm that you saved them and enter the first authenticator code before continuing.

Sign in with single sign-on

Solidlio is the OAuth client, not the app. Every customer brings their own Entra or Google app registration, so a native client would need each customer to whitelist a mobile redirect URI.

1. Tap Sign in with Microsoft / Sign in with Google.
2. The system browser opens — not an embedded web view. Google refuses authorization requests from embedded web views with disallowed_useragent, so this is required, not preferred.
3. You authenticate with your own identity provider.
4. The server hands the finished session back to the app as a one-time code on an App Link (https://solidlio.com/app/oauth/callback). The code lives 60 seconds and is single-use.
5. The app exchanges the code for a session and loads your profile.

No client secret ever reaches the device.

If SSO opens the browser and then leaves you in the browser, the OS did not route the App Link into the app. The host must serve the association files: https://<host>/.well-known/apple-app-site-association (as application/json, over HTTPS, no redirect) and https://<host>/.well-known/assetlinks.json. Android checks assetlinks.json at install time; if that check fails, the link silently opens in the browser instead.

Sign in with a magic link

1. On the login screen, enter your email and tap Continue, then choose Email me a sign-in link.
2. Confirm the pre-filled email and tap Send Magic Link.
3. Open the email on the same device and tap the link. Because the request came from the app, the link is built under the app’s App Link scope, so the OS opens the app rather than the browser.
4. The app completes the sign-in and takes you to your portal.

The link expires in 15 minutes and can be used once.

Turn on biometric unlock

1. Sign in with your password at least once — unlock releases the session already stored on this device, so there has to be one.
2. Go to More → Settings → Security (MSP and Organization) or Settings → Security (Customer).
3. Tap Use Face ID / Use Touch ID and confirm with the device prompt.

From then on, the login screen offers a biometric button. Your biometric data never leaves the device; the OS only tells the app pass or fail, and on a pass the app spends the stored refresh token. Signing out turns biometric unlock off, because signing out deletes the token there is to release.

Switch role, workspace or MSP client

1. Tap the people/role control on a dashboard or in More → Switch Role & Workspace.
2. Choose an organization membership, then choose one of the role views that membership permits: End User, Org Tech, Org Admin, MSP Tech or MSP Admin. Higher-role memberships may choose a lower operational view.
3. In an MSP view, tap Client Scope and select All Clients for the cross-client service desk or one managed client for a site-specific view.
4. The client choice persists for the MSP account and follows you through the dashboard, Tickets, My Work, Assets, Projects, Changes, Calendar, IPAM, Monitoring, Locations, Software & Licenses, Quotes, Invoices and Contracts. It also preselects the client in supported create forms.
5. A selected client is always validated by the server. A stale, revoked or offboarded client is cleared, and an organization outside the MSP’s visible scope is rejected.

Client scope is a filter, not impersonation: it does not turn the technician into the client’s administrator and does not expose client acquisition or storefront functionality.

Work a ticket (MSP portal)

1. Tickets tab → tap a ticket.
2. The client organization is named in a banner at the top.
3. Update Status — tap one of New, Open, In Progress, Waiting Customer, Waiting Vendor, On Hold, Resolved, Closed. The current status is disabled.
4. Comments tab — type, and toggle Internal / Public before sending. Internal comments are visibly flagged.
5. Attachments — add a document, choose a photo, or take a support photo. Files remain private behind the ticket attachment API and are limited to 16 MB each.
6. Time tab — Start timer. Optionally type what you are working on and set the Billable switch. The clock runs on the server, so closing the app does not stop it, and you can stop it from the web instead.
7. Stop & log writes the time entry. Discard throws the elapsed time away after confirming.

Only one timer runs per person. If one is already running on other work, the Time tab shows what it is running on instead of a button that would be refused.

Scan an asset

1. MSP portal: More → Assets → Scan. Organization portal: Assets → Scan.
2. Grant camera access the first time.
3. Point the camera at a QR code or barcode. Supported symbologies: QR, Code 128, Code 39, EAN-13, EAN-8.
4. On a match the app opens the asset.
5. If nothing matches, an authorized asset administrator is offered Scan again or Create new. A read-only Org Tech view is offered Scan again only.
6. If the lookup failed — no connection, service down — you are told so and offered Scan again only. A failed lookup is never reported as “not found”, because creating a “new” asset at that point produces a duplicate of one that already exists.

Clear approvals

1. More → Approvals in the MSP or Organization portal.
2. The list merges procurement approvals (vendor invoices, purchase orders) and change approvals from two different services. A source your plan does not include contributes nothing rather than failing the screen.
3. Approve decides immediately. Reject asks for a reason first.
4. Tapping a change approval opens the change request behind it.

A failed load says so and offers a retry. It never renders as “All caught up” — an empty approvals screen and a broken approvals screen must not look alike.

Generate a report

1. More → Reports.
2. Tiles show total, ready, queued and failed counts for your account.
3. Generate a report → pick a type. A technician is not offered Revenue, Revenue Summary or Profitability, because the service refuses those three to that role.
4. The report is queued. A report is an artifact, not a live query: the server renders it out of band and the screen polls every 5 seconds until it settles.
5. When it is ready, Open streams it. The download is an authenticated API call that re-checks your account, not a public link.
6. Delete removes it.

Accept or decline a quote

Available in the Customer portal (Quotes) and the Organization portal (More → Quotes).

1. Open the quote. Opening it moves a quote from Sent to Viewed — which is what makes it decidable, so the buttons appear on the first open.
2. A quote is eligible for Accept only when every material line is classified as one-time physical hardware delivered physically. Type the signatory’s name (prefilled from your profile), choose a drawn or typed electronic signature, and confirm. Both the name and signature are required; acceptance records who accepted, when and from which address.
3. Decline — give a reason. The reason is required, and it is shown on the quote so it can be revised.
4. A quote containing software, licenses, subscriptions, services, recurring charges, mixed delivery or an unclassified line is review-only in mobile. It may still be declined. The app does not link to a purchase destination.
5. An expired quote shows neither button. The buttons are driven by server eligibility, not a status or product guess in the app.

Review an invoice

Available in the Customer portal (Invoices) and the Organization portal (More → Invoices).

Open an invoice to review its status, dates, line items, totals and outstanding balance. Invoices are view-only because one invoice can combine hardware, software, subscriptions and services. The app contains no Pay button, payment method management or purchase link.

Track an order or delivery

1. Customer portal: More → Orders & Delivery. Organization portal: More → Orders & Delivery.
2. Open a shipment to see its carrier, tracking number, shipping method, destination city/region, package and item counts, delivery estimate and tracking history.
3. Shipment data is read-only and scoped to the signed-in organization. Costs, street addresses, internal notes and raw carrier payloads are not returned.

Turn on push notifications

1. More → Settings → Notifications (any portal — preferences are per person, so one screen serves all three).
2. If the banner says notifications are disabled, tap it to grant OS permission.
3. Delivery Channels — In-App, Email, Push. Push cannot be switched on until the OS permission is granted.
4. What to Notify — per-category switches over Tickets, Changes, Projects, Calendar, Billing, Assets & Licences, Co-management and System.
5. Quiet Hours — one daily window, evaluated in your own timezone. Quiet hours suppress push only; the in-app stream keeps working.

Accepting the OS permission prompt on your first device switches the push channel on for you. A second device does not, because by then you may have deliberately turned it off.

The notification inbox is separate from delivery preferences: open Notifications from More to filter unread items, mark all read, remove an item or open the ticket, change, project, approval or other real destination.

Work with no connection

Four actions can be started offline: creating a ticket, commenting on a ticket, creating an asset, and stopping a timer into a time entry. Each is held on the device and sent when a connection returns, or when the app is brought back to the foreground.

Held work is written to device storage, so it survives the app being closed or reclaimed by the operating system. An item is removed only once the server has accepted it. A request the server permanently rejects — a 4xx that is not 401, 408 or 429 — is dropped with a log rather than blocking everything queued behind it, and anything that fails five times is given up on.

Reading offline is not supported. There is no persisted read cache: opening the app with no connection shows empty screens, not last-known data.

Configuration

Per-user

Plan tiers

The app itself is not plan-gated — it is a client over the same API as the web portal, and it is available on every tier. What it can show follows the same entitlements the web portal obeys.

Enterprise SSO requires an identity provider to be configured on the organization, which is itself gated on ssoEnabled.

Troubleshooting

Limits and known behaviour

• Not on the App Store or Google Play. Builds are internal.
• No offline reading. The offline queue covers writes only.
• No storefront or mobile payment. Catalog, cart, checkout, payment methods, general invoice payment, subscription creation and license provisioning remain outside the app.
• Signature capture is quote acceptance only. There is no technician signature-on-completion for a job.
• No AI assistant. There is no chat assistant in the app.
• Terms of Service and Privacy Policy open the public web pages in the system browser. The app ships no copy of either document.
• Branding, SLA policies, queues and roles are read-only from the app. Those settings rows are visibly inert and labelled “manage on the web”.
• Monitoring alert notifications do not push. The notification categories for acknowledging and escalating alerts are wired but latent — no service currently dispatches them.