Skip to main content
POST
Register an OAuth client

Authorizations

Authorization
string
header
required

Same flow; ledger:write is required for any mutation.

Headers

Idempotency-Key
string

Required on writes. Stable identifier you choose. The same key always returns the same transaction, forever. Can also be supplied as idempotency_key in the request body. Header wins.

Allowed character set: A-Z, a-z, 0-9, _, :, ., -. Max 255 bytes. Replays of an accepted key return the original response with header Idempotent-Replayed: true so callers can tell a replay from a freshly-committed result.

Required string length: 1 - 255
Pattern: ^[A-Za-z0-9_:.\-]+$
Example:

"pi_acme_1234_capture"

Body

application/json
name
string
required
Maximum string length: 200
Example:

"ci-keys"

mode
enum<string>
required
Available options:
live,
test
scopes
enum<string>[]
required
Available options:
ledger:read,
ledger:write,
ledger:period_close,
ledger:clients:read,
ledger:clients:write
Example:
ledger_id
string<uuid>
required

Ledger this client is pinned to. Must match mode.

Response

Client created. Body includes one-time client_secret.

object
enum<string>
required
Available options:
oauth_client
id
string
required

The client_id, prefixed client_.

Example:

"client_3Jx9XfQwVZBfwUyZQ8H6"

name
string
required
Example:

"ci-keys"

scopes
string[]
required
mode
enum<string>
required
Available options:
live,
test
active
boolean
required
created_at
string<date-time>
required
ledger_id
string<uuid> | null
last_used_at
string<date-time> | null
client_secret
string

Plaintext secret. Returned only on create + rotate.

client_secret_note
string

Hint to the integrator that the secret is shown once.

previous_secret_expires_at
string<date-time>

Returned on rotate. UTC timestamp 24h in the future, until which the previous secret continues to authenticate at POST /oauth/token.