A system, comprising: at least one computing device; and a service provider (209, 209a, 209N) executable by the at least one computing device, the service provider (209, 209a, 209N) configured to cause the at least one computing device to at least: receive an access request from a first client application (224, 224a, 224N) executed in a client device, wherein the first client application (224, 224a, 224N) is containerised; cause the first client application (224, 224a, 224N), using a redirection response that redirects the access request from the service provider (209, 209a, 209N) to an identity provider, to request an authentication token from a second client application executed in the client device, the authentication token being requested by the first client application (224, 224a, 224N) using a local uniform resource locator beginning with a predefined scheme name that is registered with the client device to correspond to the second client application; receive the authentication token from the first client application (224, 224a, 224N), the authentication token being provided from the identity provider to the first client application (224, 224a, 224N) via the second client application; and authenticate the first client application (224, 224a, 224N) in response to verifying the authentication token. at least one computing device; and a service provider (209, 209a, 209N) executable by the at least one computing device, the service provider (209, 209a, 209N) configured to cause the at least one computing device to at least: receive an access request from a first client application (224, 224a, 224N) executed in a client device, wherein the first client application (224, 224a, 224N) is containerised; cause the first client application (224, 224a, 224N), using a redirection response that redirects the access request from the service provider (209, 209a, 209N) to an identity provider, to request an authentication token from a second client application executed in the client device, the authentication token being requested by the first client application (224, 224a, 224N) using a local uniform resource locator beginning with a predefined scheme name that is registered with the client device to correspond to the second client application; receive the authentication token from the first client application (224, 224a, 224N), the authentication token being provided from the identity provider to the first client application (224, 224a, 224N) via the second client application; and authenticate the first client application (224, 224a, 224N) in response to verifying the authentication token. receive an access request from a first client application (224, 224a, 224N) executed in a client device, wherein the first client application (224, 224a, 224N) is containerised; cause the first client application (224, 224a, 224N), using a redirection response that redirects the access request from the service provider (209, 209a, 209N) to an identity provider, to request an authentication token from a second client application executed in the client device, the authentication token being requested by the first client application (224, 224a, 224N) using a local uniform resource locator beginning with a predefined scheme name that is registered with the client device to correspond to the second client application; receive the authentication token from the first client application (224, 224a, 224N), the authentication token being provided from the identity provider to the first client application (224, 224a, 224N) via the second client application; and authenticate the first client application (224, 224a, 224N) in response to verifying the authentication token.