> For the complete documentation index, see [llms.txt](https://docs.autentique.com.br/api/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.autentique.com.br/api/integration-basics/oauth2/creating-an-oauth-application.md).

# Creating an OAuth application

Create an OAuth application so Autentique users can authorize your integration to access data on their behalf.

## Before you begin

Open [Applications](https://painel.autentique.com.br/perfil/aplicativos) in the dashboard. This menu is available to organization admins or members with the `"Can manage organization applications"` permission.

Each OAuth application represents one integration. It receives a public **Client ID** and a confidential **Client Secret**, which the OAuth flow uses.

## Enter the application details

<figure><img src="/files/zWsl14wu2Zte0uKP7jrG" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/C43BrhzKEzavV3jLQJ0D" alt=""><figcaption></figcaption></figure>

### Redirect URL

The redirect URL is where Autentique sends the user after they approve, deny, or cannot complete authorization. It must exactly match the value sent when authorization begins and when the authorization code is exchanged.

Use HTTPS in production. Local development may use HTTP only with `localhost`, `127.0.0.1`, or the IPv6 loopback address, such as `http://[::1]:3000/callback`. Do not use wildcards, URLs with variable parameters, or URLs controlled by a third party.

## Select permissions

Configured permissions set the maximum your OAuth application can request. For each authorization, request a subset of them. A user may grant fewer permissions on the consent screen.

| Permission         | Allows                                    | Related guide                                                                                                                                                                                                   |
| ------------------ | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `user:read`        | Read the authorized user's account data.  | <ul><li><a href="/pages/aZSTtShwIuMQtQipmR8F">Fetch current user</a></li></ul>                                                                                                                                  |
| `documents:read`   | Retrieve one document and list documents. | <ul><li><a href="/pages/-LsYgEpXilJyyGsfTnN1#retrieving-a-specific-document">Retrieving a specific document</a></li><li><a href="/pages/-LsYgEpXilJyyGsfTnN1#listing-documents">Listing documents</a></li></ul> |
| `documents:create` | Create documents.                         | <ul><li><a href="/pages/-LsYgNLWMNqAlDnd53uc">Creating a document</a></li></ul>                                                                                                                                 |
| `documents:update` | Edit existing documents.                  | <ul><li><a href="/pages/8U3uZ9YKlDhG179VIWu3">Editing a document</a></li></ul>                                                                                                                                  |

Request only what you need. For example, an integration that only retrieves documents should request `documents:read`, without create or update permissions.

## Store your credentials

After you create the OAuth application, copy the **Client ID** and **Client Secret** immediately. Autentique displays the Client Secret only once. Store it in a secrets manager or another server-only configuration store.

Never put the Client Secret in browser JavaScript, a mobile application, a repository, a log, or an analytics tool. If you lose it, you cannot view it again; create a new OAuth application.

## Keep the application secure

Select the OAuth application from the **Applications** list to edit its name, description, icon, redirect URL, or permissions. Review the redirect URL and permissions before saving because they control the authorization destination and the integration's access.

To rotate a Client Secret, create a new OAuth application, update the integration with the new credentials, and revoke the previous application when the transition ends. Revocation disables the OAuth application and its tokens but preserves its usage history.

Revoke an OAuth application immediately if you suspect exposure, discontinue the integration, or no longer need it to access users' accounts.