Skip to main content

Managing OAuth Clients

Create and manage OAuth clients in the SyAuth Dashboard.

What is an OAuth Client?​

An OAuth Client (Application) represents your software that uses SyAuth for authentication. Each client gets credentials to authenticate users.

Viewing OAuth Clients​

  1. Log in to the SyAuth Dashboard.
  2. Click OAuth Clients in the sidebar.
  3. View your list of clients.

Creating an OAuth Client​

  1. Click Create OAuth Client
  2. Fill in the form:
FieldDescriptionRequired
NameDisplay name✅
DescriptionOptional description❌
Client TypeConfidential or Public✅
Redirect URIsCallback URLs (one per line)✅
  1. Click Create
  2. Important: Copy the Client Secret immediately - it's shown only once!

OAuth Client Credentials​

After creating an OAuth client:

CredentialDescriptionVisibility
Client IDPublic identifierSafe for frontend
Client SecretSecret keyServer-side only

Security: Never expose the Client Secret in client-side code.

Client Types​

  • For modern web apps (Next.js, Django, React), mobile apps, and SPAs.
  • Uses PKCE (Proof Key for Code Exchange) for security.
  • Does not require a Client Secret, making it more secure and easier to manage.

Confidential​

  • For machine-to-machine (M2M) services or legacy server-rendered apps that cannot use PKCE.
  • Requires storing a Client Secret securely on your server.
  • Uses Client Secret for token exchange.

Editing an OAuth Client​

  1. Click on the client name
  2. Update fields:
    • Name and description
    • Redirect URIs
    • Allowed scopes
  3. Click Save Changes

Managing Redirect URIs​

Redirect URIs are where users return after authentication.

Adding URIs​

http://localhost:3000/auth/callback
https://staging.yourapp.com/auth/callback
https://yourapp.com/auth/callback

Best Practices​

  • Use HTTPS in production
  • Add separate URIs for each environment
  • Keep development URIs separate from production

Rotating Client Secret​

If your client secret is compromised:

  1. Go to the client details
  2. Click Reset Client Secret
  3. Copy the new secret
  4. Update your application configuration
  5. Deploy changes immediately

Warning: The old secret stops working immediately after rotation.

OAuth Client Branding​

Customize the Universal Login appearance for each application:

  1. Click on the client
  2. Navigate to Branding tab
  3. Configure:
    • Logo
    • Primary color
    • Theme (light/dark)
    • Welcome text

See the Universal Login settings for details.

Deleting an OAuth Client​

To delete an OAuth Client, you must do so from the main list page.

  1. Go to OAuth Clients in the sidebar.
  2. Find the client you want to delete and click the Delete (trash icon) button.
  3. A confirmation modal will appear.
  4. Validation: You must type the application name followed by /yes i accept (e.g., My App/yes i accept) to enable the delete button.
  5. Click Delete to permanently remove the client.
High Impact Action

Deleting an OAuth Client is a destructive operation that cannot be undone. It will permanently delete:

  • The OAuth Client itself and its credentials.
  • Branding configurations (Logo, colors, etc.) specific to this client.
  • All active OAuth sessions, access tokens, and refresh tokens.
  • All pending Authorization codes.

Note: Users and Groups are NOT deleted, as they belong to your Workspace. However, users will no longer be able to log in using this specific Client ID.

OAuth Client Settings​

SettingDescription
Allowed ScopesWhich scopes the app can request
Token LifetimeAccess token expiration time
Refresh TokenEnable/disable refresh tokens

Next Steps​

  • Managing Users - View application users
  • the Universal Login settings - Customize branding