Skip to main content

Applications and Quick Build

In Applications, configure the client type, redirect URIs, grants and scopes for each application. Use public clients for applications that cannot keep secrets and authorization code with S256 PKCE for interactive login. Confidential clients keep their secrets on a server.

For your first test, follow application registration in setup. Select the intended workspace, save one client, and reopen its details to check the client ID and callback URL. If you have no app, use the public-client settings and the provided callback receiver.

Use client_id for sign-in and the resource id for configuration requests. Save a new/reset secret when shown; later reads hide it. Resetting a secret requires updating applications that use the old value.

Quick Build​

Quick Build creates an OAuth client, workspace API tokens, email templates and optional social-provider configurations together. Provide workspace, company name, administrative contact, login methods and callback URLs. Social sign-in also needs credentials from the selected provider's developer console.

Quick Build prepares configuration resources. It does not create an app on your computer or host the callback page. If it suggests https://localhost:3000/auth/callback, use that address only when you actually have an app listening there.

To use its result:

  1. Check the workspace and callback before submitting Quick Build. For the no-app receiver, use http://127.0.0.1:8080/callback.
  2. After creation, open the generated client in Applications. Copy its client ID and check its type, callback, grants and scopes. The manual receiver requires a public client; adjust the client settings or create a public test client if necessary.
  3. Open Email templates and check the generated verification template. If social login was selected, check the provider settings as well.
  4. Start a fresh hosted-login test. The result you are looking for is login, approval and a callback received by your app or the test receiver.

Review the generated client, template content and environment suggestions before copying them into your application. Keep secrets server-side. Quick Build creates resources; running it again can create more resources. Its generated workspace token is not a JSON-registration API key.

Use authorization_code, refresh_token or client_credentials as applicable. The token endpoint does not implement the password grant even if a generated client configuration contains it. Check that email variable placeholders use double braces.

If creation fails, read the returned field, permission or plan error and check the existing resources before running Quick Build again. If creation succeeds but login fails, troubleshoot the generated client's settings and callback; repeating Quick Build does not start a callback receiver.

Continue with hosted OAuth sign-in, client operations, or the Quick Build API.