Creating an OAuth application

Create and configure an OAuth application in the Autentique dashboard.

Create an OAuth application so Autentique users can authorize your integration to access data on their behalf.

Before you begin

Open Applications in the dashboard. This menu is available to organization admins or members with the "Can manage organization applications" permission.

Each OAuth application represents one integration. It receives a public Client ID and a confidential Client Secret, which the OAuth flow uses.

Enter the application details

Redirect URL

The redirect URL is where Autentique sends the user after they approve, deny, or cannot complete authorization. It must exactly match the value sent when authorization begins and when the authorization code is exchanged.

Use HTTPS in production. Local development may use HTTP only with localhost, 127.0.0.1, or the IPv6 loopback address, such as http://[::1]:3000/callback. Do not use wildcards, URLs with variable parameters, or URLs controlled by a third party.

Select permissions

Configured permissions set the maximum your OAuth application can request. For each authorization, request a subset of them. A user may grant fewer permissions on the consent screen.

Permission	Allows	Related guide
user:read	Read the authorized user's account data.	Fetch current user
documents:read	Retrieve one document and list documents.	Retrieving a specific document Listing documents
documents:create	Create documents.	Creating a document
documents:update	Edit existing documents.	Editing a document

Request only what you need. For example, an integration that only retrieves documents should request documents:read, without create or update permissions.

Store your credentials

After you create the OAuth application, copy the Client ID and Client Secret immediately. Autentique displays the Client Secret only once. Store it in a secrets manager or another server-only configuration store.

Never put the Client Secret in browser JavaScript, a mobile application, a repository, a log, or an analytics tool. If you lose it, you cannot view it again; create a new OAuth application.

Keep the application secure

Select the OAuth application from the Applications list to edit its name, description, icon, redirect URL, or permissions. Review the redirect URL and permissions before saving because they control the authorization destination and the integration's access.

To rotate a Client Secret, create a new OAuth application, update the integration with the new credentials, and revoke the previous application when the transition ends. Revocation disables the OAuth application and its tokens but preserves its usage history.

Revoke an OAuth application immediately if you suspect exposure, discontinue the integration, or no longer need it to access users' accounts.