Register a new OAuth client

post

{protocol}://{base-url}/integration/core/v1/oauth/clients

Creates a public or confidential OAuth client.
Rules:
- Public clients must have pkce_required = true (defaults to true if omitted).
- client_secret is returned only on creation and during secret rotation.
- Redirect URIs must use HTTPS, except for http://localhost or http://127.0.0.1 (for development).

Body Params

Core OAuth client configuration fields shared across request/response bodies.

name

string

required

length ≥ 1

A unique display name for the OAuth client application.

client_type

string

enum

required

The type of OAuth client.

public: Apps that cannot securely store secrets (SPAs, mobile).
confidential: Apps that can securely store secrets (backends).

Allowed:

redirect_uris

array of uris

required

length between 1 and 50

Allowed redirect URIs for OAuth callbacks.

Max 50 entries.
HTTP is allowed only for localhost or 127.0.0.1 (development).
All other URIs must use HTTPS.

redirect_uris*

refresh_token_expiry

integer

required

259200 to 15552000

Refresh token lifetime in seconds.

Min: 259,200 (3 days)
Max: 15,552,000 (180 days)

access_token_expiry

integer

required

3600 to 259200

Access token lifetime in seconds.

Min: 3,600 (1 hour)
Max: 259,200 (3 days)

pkce_required

boolean

required

Whether PKCE (Proof Key for Code Exchange) is enforced.

Must be true for public clients (defaults to true if omitted on registration).
May be true or false for confidential clients.

Responses

Language

Credentials

Bearer

URL

Loading…

Response

Choose an example:

application/json

201Client registered successfully.

400Invalid request.

401Unauthorized request.

403Forbidden request.

405Method not allowed.

500Internal server error.