Version: v0.25.0 (Latest)

Register clients

Step 3 of 4 in Configure the authorization server.

Loading example...

For Postman or a backend service, register a confidential client with client_credentials, no redirect URIs, explicit audiences and an explicit token endpoint authentication method:

{
  "clientId": "acme-service",
  "clientName": "Acme developer service",
  "clientType": "confidential",
  "enabled": true,
  "grantTypes": ["client_credentials"],
  "responseTypes": [],
  "redirectUris": [],
  "tokenEndpointAuthMethod": "client_secret_post",
  "principalRoles": ["tenant-admin"],
  "defaultAccessTokenAudience": "enterprise-platform",
  "allowedAccessTokenAudiences": ["enterprise-tenant-kms", "enterprise-tenant-did", "enterprise-tenant-as", "enterprise-issuer", "enterprise-verifier"],
  "clientCredential": {"method": "client_secret_post", "clientId": "acme-service", "secretValue": "<generated secret>"}
}

Loading example...

You supply the secret once in clientCredential.secretValue; it is stored through secret management and reads return only clientCredential.secretReference, so keep your copy. client_secret_post and client_secret_basic are not interchangeable, and a mismatch returns invalid_client. Browser and native clients use authorization_code with exact HTTPS redirect URIs and PKCE S256; they never receive client_credentials or a service role.

Read a client back after registration to confirm grants, redirects and audiences:

Loading example...

Continue with step 4, Tune token and grant settings.

Next​

Next