Skip to content
Authometry Dashboard

Start

Getting startedApplications

OAuth and OIDC

Authorization Code with PKCERedirect URI matchingToken endpointDevice Authorization

Operate

MCP serverConfiguration as codeAccount provisioningWebhook verificationErrors and traces

Start

Applications

Choose a client type, register exact URLs, assign grants, and rotate credentials.

Choose a type

  • Web applications run a confidential backend and normally use client_secret_basic.
  • SPAs and native applications are public clients. They do not receive a secret and must use S256 PKCE.
  • Machine applications use Client Credentials and represent the application rather than a user.
  • Device applications exchange a user-approved device code from an input-constrained client.

Configure URLs

Redirect and post-logout URLs are allowlists, not patterns. Scheme, host, port, path, query, and trailing slash must match the request. Register separate development and production values explicitly.

http://localhost:3000/callback and http://127.0.0.1:3000/callback are different URLs.

Grant access

Enable only grants the client actually uses and assign only its required scopes. Requesting an unassigned scope stops authorization with invalid_scope and records the expected assignment in the trace.

Rotate a secret

  • Create a second named credential and copy the raw value once.
  • Deploy it to every client instance and confirm successful use.
  • Revoke the old credential after the rollout completes.

ON THIS PAGE

Choose a typeConfigure URLsGrant accessRotate a secret