Documentation / OAuth Applications

OAuth Applications

Create and manage OAuth applications connected to your Configo account.

Overview

The OAuth Applications page lets you view and manage the applications connected to your account via OAuth. From here you can create new applications, edit existing ones, view their access permissions, and remove applications you no longer need.

Application list

The page shows a table of your OAuth applications with the following information:

  • Name — the name of the application. Public clients (see below) carry a Public client (no secret) badge.
  • Created — the date the application was added.

If you haven't created any applications yet, the table will show an empty state instead.

Creating an application

  1. Click the Add button at the top of the page.
  2. Enter an application name.
  3. Enter one or more redirect URIs (one per line) — these are the addresses your application will be redirected to after authorization.
  4. Select the permissions (scopes) the application should have access to. At least one permission must be selected before saving.
  5. If your application has no backend of its own — a CLI tool, a browser extension, a single-page app — enable Public client (no secret). No client secret will be issued; the application authenticates using PKCE instead (see below).
  6. Click Save.

After saving, you'll be shown the application's Client ID — and, unless you created a public client, its Client Secret — once. The secret is hidden by default — click the eye icon to reveal it, the copy icon to copy it, or Download to save the credentials as a text file.

Important: the client secret is shown only once and is not stored anywhere you can retrieve it later. Make sure to save it before closing this screen.

Public clients

A public client has no client secret at all, which is the correct setup for an application that can't keep one confidential — anything distributed to end users, such as a CLI tool, browser extension, or single-page app. Instead of a secret, it must use PKCE (code_challenge / code_verifier, method S256) to protect the authorization code exchange; requests that skip PKCE are rejected. Once created, a client's public/confidential status can't be changed — delete it and create a new one if you need to switch. See the API Reference for the technical details of the PKCE flow.

Editing an application

  1. Click the edit icon next to an application in the list.
  2. Update the name, redirect URIs, or permissions as needed.
  3. Click Save.

Editing an application does not generate a new secret — your existing credentials remain valid.

Deleting an application

Click the delete icon next to an application to remove it. The application is removed from the list immediately, and any integrations using its credentials will stop working.

Permissions (scopes)

Each application must be granted at least one permission, which determines what it's allowed to access on your behalf. Permissions can be toggled on or off individually when creating or editing an application.