A system , comprising: at least one computing device; and a service provider executable by the at least one computing device, the service provider configured to cause the at least one computing device to at least: receive an access request from a first client application executed in a client device , wherein the first client application is containerised; cause the first client application , using a redirection response that redirects the access request from the service provider to an identity provider , to request an authentication token from a second client application executed in the client device , the authentication token being requested by the first client application using a local uniform resource locator beginning with a predefined scheme name that is registered with the client device to correspond to the second client application ; receive the authentication token from the first client application , the authentication token being provided from the identity provider to the first client application via the second client application ; and authenticate the first client application in response to verifying the authentication token. at least one computing device; and a service provider executable by the at least one computing device, the service provider configured to cause the at least one computing device to at least: receive an access request from a first client application executed in a client device , wherein the first client application is containerised; cause the first client application , using a redirection response that redirects the access request from the service provider to an identity provider , to request an authentication token from a second client application executed in the client device , the authentication token being requested by the first client application using a local uniform resource locator beginning with a predefined scheme name that is registered with the client device to correspond to the second client application ; receive the authentication token from the first client application , the authentication token being provided from the identity provider to the first client application via the second client application ; and authenticate the first client application in response to verifying the authentication token. receive an access request from a first client application executed in a client device , wherein the first client application is containerised; cause the first client application , using a redirection response that redirects the access request from the service provider to an identity provider , to request an authentication token from a second client application executed in the client device , the authentication token being requested by the first client application using a local uniform resource locator beginning with a predefined scheme name that is registered with the client device to correspond to the second client application ; receive the authentication token from the first client application , the authentication token being provided from the identity provider to the first client application via the second client application ; and authenticate the first client application in response to verifying the authentication token. <EOS>