Clerk API (unofficial showcase)
POST/oauth_applications

Create an OAuth application

Creates a new OAuth application with the given name and callback URL for an instance. The callback URL must be a valid URL. All URL schemes are allowed such as http://, https://, myapp://, etc...

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

11 body fields
namestringrequired
The name of the new OAuth application. Max length: 256
redirect_urisarray<string>optional
An array of redirect URIs of the new OAuth application
callback_urlstringdeprecatedoptional
The callback URL of the new OAuth application
scopesstringoptional
Define the application's built-in and custom scope ceiling. Provide scope keys as a space-delimited string. Custom keys must exist in the instance OAuth scope catalog.
Default:profile email
consent_screen_enabledbooleanoptional
True to enable a consent screen to display in the authentication flow.
Default:true
pkce_requiredbooleanoptional
True to require the Proof Key of Code Exchange (PKCE) flow.
Default:false
audience_uristringoptional
An absolute resource URI for a confidential application (RFC 8707 section 2). Registers a resource with no accepted scopes, or adopts an unowned resource with confirmation. Every claimed URI remains permanently reserved to this app, including retirement and deletion, and counts toward the instance resource quota. Changing it stops new exchanges from the old audience immediately. Already-issued tokens retain their lifetime. Clearing requires exchange disabled in an earlier update.
token_exchange_enabledbooleanoptional
Enable exchanges from the active audience. Requires an audience URI. Disabling preserves target configuration.
adopt_audience_resourcebooleanoptional
Confirm adoption of an existing unowned resource, preserving its accepted scopes and target references. Does not override another application's reservation.
device_authorization_grant_enabledbooleanoptional
True to enable the OAuth Device Authorization Grant for this application. Enabling requires the new OAuth IdP and a reachable device verification page.
Default:false
publicbooleanoptional
If true, this client is public and you can use the Proof Key of Code Exchange (PKCE) flow.

4 status codes
200An OAuth application with client secret
objectstringrequired
Allowed:oauth_application
idstringrequired
instance_idstringrequired
namestringrequired
client_idstringrequired
client_uristringrequired
client_image_urlstringrequired
dynamically_registeredbooleanrequired
consent_screen_enabledbooleanrequired
pkce_requiredbooleanrequired
audience_uristringrequired
The active application audience URI, whose registry identity is permanently reserved to this application.
token_exchange_enabledbooleanrequired
Whether this confidential application accepts token exchanges from its active audience.
device_authorization_grant_enabledbooleanrequired
publicbooleanrequired
scopesstringrequired
The complete scope ceiling for the OAuth application, as a space-delimited list of built-in and assigned custom scope keys.
redirect_urisarray<string>required
callback_urlstringdeprecatedrequired
Deprecated: Use redirect_uris instead.
authorize_urlstringrequired
token_fetch_urlstringrequired
user_info_urlstringrequired
discovery_urlstringrequired
token_introspection_urlstringrequired
created_atintegerrequired
Unix timestamp of creation.
updated_atintegerrequired
Unix timestamp of last update.
client_secretstringoptional
Empty if public client.
400Request was not successful
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional
403Authorization invalid
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional
422Invalid request parameters
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional

Error handling

A 400 is returned: Request was not successful. A 403 is returned: Authorization invalid. A 422 is returned: Invalid request parameters.