Register a client app

Request

okta.clients.register

Registers a new client app

Note: You can create apps on the Apps endpoint (/api/v1/apps) and default to consent_method=TRUSTED, while those created with Dynamic Client Registration (/oauth2/v1/clients) default to consent_method=REQUIRED.

Note: If you want to specify the client_id or client_secret, you can use the Applications API to create or update a client app.

Different app types have different valid values for the corresponding grant type:

App Type	Valid Grant Type	Requirements
`browser`	`authorization_code`, `implicit`, `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob`
`native`	`authorization_code`, `implicit`, `password`, `refresh_token`, `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob`	Must have at least `authorization_code`
`service`	`client_credentials`, `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob`	Works with the OAuth 2.0 flow (not OpenID Connect)
`web`	`authorization_code`, `implicit`, `refresh_token`, `client_credentials`(*), `urn:ietf:params:oauth:grant-type:saml2-bearer`. The following grant types are only: `urn:okta:params:oauth:grant-type:otp`, `urn:okta:params:oauth:grant-type:oob`, `http://auth0.com/oauth/grant-type/mfa-otp`, `http://auth0.com/oauth/grant-type/mfa-oob`	Must have at least `authorization_code`

Note: The client_credentials grant with a web app type allows you to use one client_id for an app that needs to make user-specific calls and back-end calls for data.

Note: The grant_types and response_types values described above are partially orthogonal, as they refer to arguments passed to different endpoints in the OAuth 2.0 protocol. However, they are related in that the grant_types available to a client influence the response_types that the client is allowed to use and vice versa. For instance, a grant_types value that includes authorization_code implies a response_types value that includes code, as both values are defined as part of the OAuth 2.0 authorization code grant.

Bodyapplication/jsonrequired

application_typestring(ApplicationType)

The type of client app

Default:"web"

Enum:"browser""native""service""web"

client_namestringrequired

Human-readable string name of the client app

frontchannel_logout_session_requiredboolean

Include user session details

frontchannel_logout_uristring or null

URL where Okta sends the logout request

grant_typesArray of strings

Array of OAuth 2.0 grant type strings. Default value: [authorization_code]

id_token_encrypted_response_algstring(OAuthIdTokenKeyEncryptionAlgorithm)

JWE alg algorithm for encrypting the ID token issued to this client. If this is requested, the response is signed, and then encrypted with the result being a nested JWT. The default, if omitted, is that no encryption is performed.

Enum:"RSA-OAEP-256""RSA-OAEP-384""RSA-OAEP-512"

initiate_login_uristring

URL that a third party can use to initiate a sign-in flow by the client

jwksobject

A JSON Web Key Set for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client

jwks_uristring

URL string that references a JSON Web Key Set for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client

logo_uristring or null

URL string that references a logo for the client consent dialog (not the sign-in dialog)

policy_uristring or null

URL string of a web page providing the client's policy document

post_logout_redirect_urisstring

Array of redirection URI strings for use for relying party initiated logouts

redirect_urisArray of strings

Array of redirection URI strings for use in redirect-based flows. All redirect URIs must be absolute URIs and must not include a fragment component. At least one redirect URI and response type is required for all client types, with the following exceptions: If the client uses the Resource Owner Password flow (if grant_type contains the value password) or the Client Credentials flow (if grant_type contains the value client_credentials), then no redirect URI or response type is necessary. In these cases, you can pass either null or an empty array for these attributes.

request_object_signing_algstring(SigningAlgorithm)

The type of JSON Web Key Set algorithm that you must use for signing request objects. When you specify a value for the request_object_signing_alg property, all request objects from the client are rejected if not signed with the specified algorithm. You must use the algorithm when the request object is passed by value (using the request parameter). If a value for request_object_signing_alg isn't specified, the default is any algorithm that's supported by both the client and the server.

Enum:"ES256""ES384""ES512""HS256""HS384""HS512""RS256""RS384""RS512"

response_typesArray of strings(ResponseType)

Array of OAuth 2.0 response type strings. Default value: [code]

Items Enum:"code""id_token""none""token"

token_endpoint_auth_methodstring(EndpointAuthMethod)

Requested authentication method for OAuth 2.0 endpoints

Enum:"client_secret_basic""client_secret_jwt""client_secret_post""none""private_key_jwt"

tos_uristring or null

URL string of a web page providing the client's terms of service document

POST

/oauth2/v1/clients

curl -i -X POST \
  https://okta-subdomain.pixtulate.com/oauth2/v1/clients \
  -H 'Content-Type: application/json' \
  -d '{
    "client_name": "Example OAuth 2.0 client",
    "client_uri": "https://www.example.com",
    "logo_uri": "https://www.example.com/logo.png",
    "application_type": "web",
    "redirect_uris": [
      "https://www.example.com/oauth2/redirectUri"
    ],
    "post_logout_redirect_uris": [
      "https://www.example.com/oauth2/postLogoutRedirectUri"
    ],
    "response_types": [
      "code",
      "id_token"
    ],
    "grant_types": [
      "authorization_code",
      "refresh_token",
      "implicit"
    ],
    "token_endpoint_auth_method": "client_secret_post",
    "initiate_login_uri": "https://www.example.com/oauth2/login"
  }'

Responses

Created

Bodyapplication/json

application_typestring(ApplicationType)

The type of client app

Default:"web"

Enum:"browser""native""service""web"

client_idstringread-only

Unique key for the client app. The client_id is immutable. When you create a client app, you can't specify the client_id because Okta uses the app ID for the client_id.

client_id_issued_atintegerread-only

Time at which the client_id was issued (measured in unix seconds)

client_namestringrequired

Human-readable string name of the client app

client_secretstring or nullread-only

OAuth 2.0 client secret string (used for confidential clients). The client_secret is shown only on the response of the creation or update of a client app (and only if the token_endpoint_auth_method is one that requires a client secret). You can't specify the client_secret. If the token_endpoint_auth_method requires one, Okta generates a random client_secret for the client app.

client_secret_expires_atinteger or null, >= 0read-only

Time at which the client_secret expires or 0 if it doesn't expire (measured in unix seconds)

frontchannel_logout_session_requiredboolean

Include user session details

frontchannel_logout_uristring or null

URL where Okta sends the logout request

grant_typesArray of strings

Array of OAuth 2.0 grant type strings. Default value: [authorization_code]

id_token_encrypted_response_algstring(OAuthIdTokenKeyEncryptionAlgorithm)

Enum:"RSA-OAEP-256""RSA-OAEP-384""RSA-OAEP-512"

initiate_login_uristring

URL that a third party can use to initiate a sign-in flow by the client

jwksobject

A JSON Web Key Set for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client

jwks_uristring

URL string that references a JSON Web Key Set for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the client

logo_uristring or null

URL string that references a logo for the client consent dialog (not the sign-in dialog)

policy_uristring or null

URL string of a web page providing the client's policy document

post_logout_redirect_urisstring

Array of redirection URI strings for use for relying party initiated logouts

redirect_urisArray of strings

request_object_signing_algstring(SigningAlgorithm)

Enum:"ES256""ES384""ES512""HS256""HS384""HS512""RS256""RS384""RS512"

response_typesArray of strings(ResponseType)

Array of OAuth 2.0 response type strings. Default value: [code]

Items Enum:"code""id_token""none""token"

token_endpoint_auth_methodstring(EndpointAuthMethod)

Requested authentication method for OAuth 2.0 endpoints

Enum:"client_secret_basic""client_secret_jwt""client_secret_post""none""private_key_jwt"

tos_uristring or null

URL string of a web page providing the client's terms of service document

Response

{
  "client_id": "0jrabyQWm4B9zVJPbotY",
  "client_secret": "5W7XULCEs4BJKnWUXwh8lgmeXRhcGcdViFp84pWe",
  "client_id_issued_at": 1453913425,
  "client_secret_expires_at": 0,
  "client_name": "Example OAuth 2.0 client",
  "client_uri": "https://www.example.com",
  "logo_uri": "https://www.example.com/logo.png",
  "application_type": "web",
  "redirect_uris": [
    "https://www.example.com/oauth2/redirectUri"
  ],
  "post_logout_redirect_uris": [
    "https://www.example.com/oauth2/postLogoutRedirectUri"
  ],
  "response_types": [
    "id_token",
    "code"
  ],
  "grant_types": [
    "authorization_code"
  ],
  "token_endpoint_auth_method": "client_secret_post",
  "initiate_login_uri": "https://www.example.com/oauth2/login",
  "frontchannel_logout_uri": "https://example.com/logout",
  "frontchannel_logout_session_required": false
}