OAuth applications

An OAuth application gives your integration the client ID, and for a confidential application the client secret, that it needs to authenticate with our API. See Authentication for how to use them.

To manage OAuth applications, you need the Admin permission on the account. Learn more about Permissions.

Steps to create an OAuth application

1. Go to Settings (main menu) > Account > OAuth applications
2. Select Create OAuth application
3. Enter a Name
4. Select a Client type
5. Enter your Redirect URIs, one per line
6. Select Create
7. Copy the Client ID, and the Client secret if one is shown, then select Done

Client type

Select Confidential for server-side applications that can securely store a client secret. Select Public for browser, mobile or native applications that cannot — a public application gets no client secret, and PKCE protects the flow instead. The client type cannot be changed after the application has been created.

Redirect URIs

A redirect URI must use https, or http with a loopback address (localhost, 127.0.0.1 or ::1) for local development. A public application may also use a private-use URI scheme in reverse-domain notation, such as com.example.app:/oauth/callback.

Steps to change a name or redirect URI

1. Go to Settings (main menu) > Account > OAuth applications > your application
2. Change the Name or the Redirect URIs
3. Select Save

Steps to rotate a client secret

Rotate the client secret if the current one has been lost or exposed. Only confidential applications have one.

1. Go to Settings (main menu) > Account > OAuth applications > your application
2. Select Rotate client secret > Rotate secret
3. Copy the new Client secret

The previous client secret stops working immediately, so update your application as soon as you rotate. Users who have already authorized your application stay authorized.

Steps to delete an OAuth application

1. Go to Settings (main menu) > Account > OAuth applications > your application
2. Select Delete and confirm

Deleting an OAuth application revokes the authorizations users have given it. Access tokens that have already been issued may keep working until they expire.