Register an OAuth client
Mints a new client. The response includes client_secret, the
only time it is returned. Store it before discarding the
response. Requires ledger:clients:write.
Idempotency-Key header is accepted.
Authorizations
Same flow; ledger:write is required for any mutation.
Headers
Required on writes. Stable identifier you choose. The same key
always returns the same transaction, forever. Can also be supplied as
idempotency_key in the request body. Header wins.
Allowed character set: A-Z, a-z, 0-9, _, :, ., -.
Max 255 bytes. Replays of an accepted key return the original
response with header Idempotent-Replayed: true so callers can
tell a replay from a freshly-committed result.
1 - 255^[A-Za-z0-9_:.\-]+$"pi_acme_1234_capture"
Body
200"ci-keys"
live, test ledger:read, ledger:write, ledger:period_close, ledger:clients:read, ledger:clients:write Ledger this client is pinned to. Must match mode.
Response
Client created. Body includes one-time client_secret.
oauth_client The client_id, prefixed client_.
"client_3Jx9XfQwVZBfwUyZQ8H6"
"ci-keys"
live, test Plaintext secret. Returned only on create + rotate.
Hint to the integrator that the secret is shown once.
Returned on rotate. UTC timestamp 24h in the future, until which
the previous secret continues to authenticate at POST /oauth/token.