Human-readable name for this OAuth client application

Example: "Partner Portal Web App"

Unique public identifier for this OAuth client (used in authorization requests)

Example: "client_a1b2c3d4e5f6g7h8"

Confidential secret for client authentication (only for confidential clients)

Example: "secret_x1y2z3w4v5u6t7s8r9q0p1o2n3m4l5k6"

Type of OAuth client based on its ability to maintain credential confidentiality

Values: confidential, public, service

Example: "confidential"

Application platform type

Values: web, spa, mobile, native, service, device

Example: "web"

Current operational status of this client

Values: active, inactive, suspended, revoked

Example: "active"

Detailed description of the client application and its purpose

Example: "Partner integration web application for accessing customer data"

Reference to the User or service account who registered/owns this client

Reference to the Organization that owns this client application

OAuth 2.0 grant types permitted for this client

Example: ["authorization_code","refresh_token","client_credentials"]

Whitelisted redirect URIs where authorization responses can be sent (must match exactly during authorization)

Example: ["https://app.example.com/callback","https://app.example.com/oauth/callback"]

OAuth scopes this client is authorized to request

Example: ["openid","profile","email","api:read","api:write"]

Default scopes granted if no specific scopes are requested

Example: ["openid","profile"]

Target resource servers/APIs this client can access (OAuth 2.0 Resource Indicators)

Example: ["https://api.example.com","https://data.example.com"]

Authentication method used at the token endpoint

Values: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, none

Example: "client_secret_basic"

Whether PKCE (Proof Key for Code Exchange) is required for authorization code flows

Example: true

Whether user consent screen must be shown (false for first-party trusted clients)

Whether this is a first-party trusted application (owned by the same organization as the authorization server)

Example: true

Lifetime of access tokens issued to this client (in seconds)

Example: 3600

Lifetime of refresh tokens issued to this client (in seconds, null for no refresh tokens)

Example: 2592000

Lifetime of OpenID Connect ID tokens issued to this client (in seconds)

Example: 3600

Whether refresh tokens can be issued to this client

Example: true

Whether this client can request offline_access scope (long-lived refresh tokens)

Example: true

URL to client application logo (displayed during consent)

Example: "https://app.example.com/logo.png"

URL to client application homepage

Example: "https://app.example.com"

URL to privacy policy (required for consent screen)

Example: "https://app.example.com/privacy"

URL to terms of service (required for consent screen)

Example: "https://app.example.com/terms"

Allowed CORS origins for this client (for SPAs making direct token requests)

Example: ["https://app.example.com","https://staging.app.example.com"]

Whitelisted URIs where user can be redirected after logout (OIDC RP-initiated logout)

Example: ["https://app.example.com/logout","https://app.example.com/goodbye"]

Date/time when this client was registered

Example: "2024-01-15T10:00:00Z"

Date/time when this client was last used for authentication/authorization

Example: "2024-11-22T14:30:00Z"

Additional client metadata including custom attributes, integration details, or environment-specific settings

Number of active authorization grants for this client (via AuthorizationGrant)

Number of active authentication sessions using this client

Total number of unique users who have authorized this client

Number of days since this client was last used