Sign in
Client Management

Create Client

Create a new client.

post/api/{serviceId}/client/create

Path parameters

serviceIdstring required

A service ID.

Request body

numberinteger

The sequential number of the client. The value of this property is assigned by Authlete.

serviceNumberinteger

The sequential number of the service of the client application. The value of this property is assigned by Authlete.

clientNamestring

The name of the client application. This property corresponds to client_name in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

descriptionstring

The description about the client application.

clientIdinteger

The client identifier used in Authlete API calls. The value of this property is assigned by Authlete.

clientSecretstring

The client secret. A random 512-bit value encoded by base64url (86 letters). The value of this property is assigned by Authlete.

Note that Authlete issues a client secret even to a "public" client application, but the client application should not use the client secret unless it changes its client type to "confidential". That is, a public client application should behave as if it had not been issued a client secret. To be specific, a token request from a public client of Authlete should not come along with a client secret although RFC 6749, 3.2.1. Client Authentication says as follows.

Confidential clients or other clients issued client credentials MUST authenticate with the authorization server as described in Section 2.3 when making requests to the token endpoint.

clientIdAliasstring

The value of the client's client_id property used in OAuth and OpenID Connect calls. By default, this is a string version of the clientId property.

clientIdAliasEnabledboolean

Deprecated. Always set to true.

clientType'PUBLIC' | 'CONFIDENTIAL'

The client type, either CONFIDENTIAL or PUBLIC. See RFC 6749, 2.1. Client Types for details.

applicationType'WEB' | 'NATIVE'

The application type. The value of this property affects the validation steps for a redirect URI. See the description about redirectUris property for more details.

logoUristring

The URL pointing to the logo image of the client application.

This property corresponds to logo_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

contactsstring[]

An array of email addresses of people responsible for the client application.

This property corresponds to contacts in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

tlsClientCertificateBoundAccessTokensboolean

The flag to indicate whether this client use TLS client certificate bound access tokens.

dynamicallyRegisteredboolean

The flag to indicate whether this client has been registered dynamically. For more details, see RFC 7591.

softwareIdstring

The unique identifier string assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.

This property corresponds to the software_id metadata defined in 2. Client Metadata of RFC 7591.

developerstring

The unique identifier of the developer who created this client application.

softwareVersionstring

The version identifier string for the client software identified by the software ID.

This property corresponds to the software_version metadata defined in 2. Client Metadata of RFC 7591.

registrationAccessTokenHashstring

The hash of the registration access token for this client.

createdAtinteger

The time at which this client was created. The value is represented as milliseconds since the UNIX epoch (1970-01-01).

modifiedAtinteger

The time at which this client was last modified. The value is represented as milliseconds since the UNIX epoch (1970-01-01).

grantTypesGrantType[]

A string array of grant types which the client application declares that it will restrict itself to using. This property corresponds to grant_types in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

responseTypesResponseType[]

A string array of response types which the client application declares that it will restrict itself to using. This property corresponds to response_types in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

redirectUrisstring[]

Redirect URIs that the client application uses to receive a response from the authorization endpoint. Requirements for a redirect URI are as follows.

Requirements by RFC 6749 (From RFC 6749, 3.1.2. Redirection Endpoint)

  • Must be an absolute URI.
  • Must not have a fragment component.

Requirements by OpenID Connect (From "OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata, application_type")

  • The scheme of the redirect URI used for Implicit Grant by a client application whose application is web must be https. This is checked at runtime by Authlete.
  • The hostname of the redirect URI used for Implicit Grant by a client application whose application type is web must not be localhost. This is checked at runtime by Authlete.
  • The scheme of the redirect URI used by a client application whose application type is native must be either (1) a custom scheme or (2) http, which is allowed only when the hostname part is localhost. This is checked at runtime by Authlete.

Requirements by Authlete

  • Must consist of printable ASCII letters only.
  • Must not exceed 200 letters.

Note that Authlete allows the application type to be null. In other words, a client application does not have to choose web or native as its application type. If the application type is null, the requirements by OpenID Connect are not checked at runtime.

An authorization request from a client application which has not registered any redirect URI fails unless at least all the following conditions are satisfied.

  • The client type of the client application is confidential.
  • The value of response_type request parameter is code.
  • The authorization request has the redirect_uri request parameter.
  • The value of scope request parameter does not contain openid.

RFC 6749 allows partial match of redirect URI under some conditions (see RFC 6749, 3.1.2.2. Registration Requirements for details), but OpenID Connect requires exact match.

authorizationSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
authorizationEncryptionAlg'RSA1_5' | 'RSA_OAEP' | 'RSA_OAEP_256' | 'A128KW' | 'A192KW' | 'A256KW' | 'DIR' | 'ECDH_ES' | 'ECDH_ES_A128KW' | 'ECDH_ES_A192KW' | 'ECDH_ES_A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'PBES2_HS256_A128KW' | 'PBES2_HS384_A192KW' | 'PBES2_HS512_A256KW' nullable

this is the 'alg' header value for encrypted JWT tokens. Depending upon the context, this refers to key transport scheme to be used by the client and by the server. For instance:

  • as authorizationEncryptionAlg value, it refers to the encoding algorithm used by server for transporting they keys on JARM objects
  • as requestEncryptionAlg value, it refers to the expected key transport encoding algorithm that server expect from client when encrypting a Request Object
  • as idTokenEncryptionAlg value, it refers to the algorithm used by the server to key transport of id_tokens

Please note that some of the algorithms are more secure than others, some are not supported very well cross platforms and some (like RSA1_5) is known to be weak.

authorizationEncryptionEnc'A128CBC_HS256' | 'A192CBC_HS384' | 'A256CBC_HS512' | 'A128GCM' | 'A192GCM' | 'A256GCM' nullable

This is the encryption algorithm to be used when encrypting a JWT on client or server side. Depending upon the context, this refers to encryption done by the client or by the server. For instance:

  • as authorizationEncryptionEnc value, it refers to the encryption algorithm used by server when creating a JARM response
  • as requestEncryptionEnc value, it refers to the expected encryption algorithm used by the client when encrypting a Request Object
  • as idTokenEncryptionEnc value, it refers to the algorithm used by the server to encrypt id_tokens
tokenAuthMethod'NONE' | 'CLIENT_SECRET_BASIC' | 'CLIENT_SECRET_POST' | 'CLIENT_SECRET_JWT' | 'PRIVATE_KEY_JWT' | 'TLS_CLIENT_AUTH' | 'SELF_SIGNED_TLS_CLIENT_AUTH' | 'ATTEST_JWT_CLIENT_AUTH'

The client authentication method that the client application declares that it uses at the token endpoint. This property corresponds to token_endpoint_auth_method in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

tokenAuthSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
selfSignedCertificateKeyIdstring

The key ID of a JWK containing a self-signed certificate of this client.

tlsClientAuthSubjectDnstring

The string representation of the expected subject distinguished name of the certificate this client will use in mutual TLS authentication.

See tls_client_auth_subject_dn in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details.

tlsClientAuthSanDnsstring

The string representation of the expected DNS subject alternative name of the certificate this client will use in mutual TLS authentication.

See tls_client_auth_san_dns in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details.

tlsClientAuthSanUristring

The string representation of the expected URI subject alternative name of the certificate this client will use in mutual TLS authentication.

See tls_client_auth_san_uri in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details.

tlsClientAuthSanIpstring

The string representation of the expected IP address subject alternative name of the certificate this client will use in mutual TLS authentication.

See tls_client_auth_san_ip in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details.

tlsClientAuthSanEmailstring

The string representation of the expected email address subject alternative name of the certificate this client will use in mutual TLS authentication.

See tls_client_auth_san_email in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details.

parRequiredboolean

The flag to indicate whether this client is required to use the pushed authorization request endpoint. This property corresponds to the require_pushed_authorization_requests client metadata defined in "OAuth 2.0 Pushed Authorization Requests".

requestObjectRequiredboolean

The flag to indicate whether authorization requests from this client are always required to utilize a request object by using either request or request_uri request parameter.

If this flag is set to true and the service's traditionalRequestObjectProcessingApplied is set to false, authorization requests from this client are processed as if require_signed_request_object client metadata of this client is true. The metadata is defined in "JAR (JWT Secured Authorization Request)".

requestSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
requestEncryptionAlg'RSA1_5' | 'RSA_OAEP' | 'RSA_OAEP_256' | 'A128KW' | 'A192KW' | 'A256KW' | 'DIR' | 'ECDH_ES' | 'ECDH_ES_A128KW' | 'ECDH_ES_A192KW' | 'ECDH_ES_A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'PBES2_HS256_A128KW' | 'PBES2_HS384_A192KW' | 'PBES2_HS512_A256KW' nullable

this is the 'alg' header value for encrypted JWT tokens. Depending upon the context, this refers to key transport scheme to be used by the client and by the server. For instance:

  • as authorizationEncryptionAlg value, it refers to the encoding algorithm used by server for transporting they keys on JARM objects
  • as requestEncryptionAlg value, it refers to the expected key transport encoding algorithm that server expect from client when encrypting a Request Object
  • as idTokenEncryptionAlg value, it refers to the algorithm used by the server to key transport of id_tokens

Please note that some of the algorithms are more secure than others, some are not supported very well cross platforms and some (like RSA1_5) is known to be weak.

requestEncryptionEnc'A128CBC_HS256' | 'A192CBC_HS384' | 'A256CBC_HS512' | 'A128GCM' | 'A192GCM' | 'A256GCM' nullable

This is the encryption algorithm to be used when encrypting a JWT on client or server side. Depending upon the context, this refers to encryption done by the client or by the server. For instance:

  • as authorizationEncryptionEnc value, it refers to the encryption algorithm used by server when creating a JARM response
  • as requestEncryptionEnc value, it refers to the expected encryption algorithm used by the client when encrypting a Request Object
  • as idTokenEncryptionEnc value, it refers to the algorithm used by the server to encrypt id_tokens
requestUrisstring[]

An array of URLs each of which points to a request object.

Authlete requires that URLs used as values for request_uri request parameter be pre-registered. This property is used for the pre-registration. See OpenID Connect Core 1.0, 6.2. Passing a Request Object by Reference for details.

defaultMaxAgeinteger

The default maximum authentication age in seconds. This value is used when an authorization request from the client application does not have max_age request parameter.

This property corresponds to default_max_age in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

defaultAcrsstring[]

The default ACRs (Authentication Context Class References). This value is used when an authorization request from the client application has neither acr_values request parameter nor acr claim in claims request parameter.

idTokenSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
idTokenEncryptionAlg'RSA1_5' | 'RSA_OAEP' | 'RSA_OAEP_256' | 'A128KW' | 'A192KW' | 'A256KW' | 'DIR' | 'ECDH_ES' | 'ECDH_ES_A128KW' | 'ECDH_ES_A192KW' | 'ECDH_ES_A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'PBES2_HS256_A128KW' | 'PBES2_HS384_A192KW' | 'PBES2_HS512_A256KW' nullable

this is the 'alg' header value for encrypted JWT tokens. Depending upon the context, this refers to key transport scheme to be used by the client and by the server. For instance:

  • as authorizationEncryptionAlg value, it refers to the encoding algorithm used by server for transporting they keys on JARM objects
  • as requestEncryptionAlg value, it refers to the expected key transport encoding algorithm that server expect from client when encrypting a Request Object
  • as idTokenEncryptionAlg value, it refers to the algorithm used by the server to key transport of id_tokens

Please note that some of the algorithms are more secure than others, some are not supported very well cross platforms and some (like RSA1_5) is known to be weak.

idTokenEncryptionEnc'A128CBC_HS256' | 'A192CBC_HS384' | 'A256CBC_HS512' | 'A128GCM' | 'A192GCM' | 'A256GCM' nullable

This is the encryption algorithm to be used when encrypting a JWT on client or server side. Depending upon the context, this refers to encryption done by the client or by the server. For instance:

  • as authorizationEncryptionEnc value, it refers to the encryption algorithm used by server when creating a JARM response
  • as requestEncryptionEnc value, it refers to the expected encryption algorithm used by the client when encrypting a Request Object
  • as idTokenEncryptionEnc value, it refers to the algorithm used by the server to encrypt id_tokens
authTimeRequiredboolean

The flag to indicate whether this client requires auth_time claim to be embedded in the ID token.

This property corresponds to require_auth_time in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

subjectType'PUBLIC' | 'PAIRWISE'

The subject type that the client application requests. Details about the subject type are described in OpenID Connect Core 1.0, 8. Subjct Identifier Types.

This property corresponds to subject_type in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

sectorIdentifierUristring

The value of the sector identifier URI. This represents the sector_identifier_uri client metadata which is defined in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata

derivedSectorIdentifierstring

The sector identifier host component as derived from either the sector_identifier_uri or the registered redirect URI. If no sector_identifier_uri is registered and multiple redirect URIs are also registered, the value of this property is null.

jwksUristring

The URL pointing to the JWK Set of the client application. The content pointed to by the URL is JSON which complies with the format described in JSON Web Key (JWK), 5. JWK Set Format. The JWK Set must not include private keys of the client application.

If the client application requests encryption for ID tokens (from the authorization/token/userinfo endpoints) and/or signs request objects, it must make available its JWK Set containing public keys for the encryption and/or the signature at the URL of jwksUri. The service (Authlete) fetches the JWK Set from the URL as necessary.

OpenID Connect Dynamic Client Registration 1.0 says that jwks must not be used when the client can use jwks_uri, but Authlete allows both properties to be registered at the same time. However, Authlete does not use the content of jwks when jwksUri is registered.

This property corresponds to jwks_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

jwksstring

The content of the JWK Set of the client application. The format is described in JSON Web Key (JWK), 5. JWK Set Format. The JWK Set must not include private keys of the client application.

OpenID Connect Dynamic Client Registration 1.0 says that jwks must not be used when the client can use jwks_uri, but Authlete allows both properties to be registered at the same time. However, Authlete does not use the content of jwks when jwksUri is registered.

This property corresponds to jwks_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

userInfoSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
userInfoEncryptionAlg'RSA1_5' | 'RSA_OAEP' | 'RSA_OAEP_256' | 'A128KW' | 'A192KW' | 'A256KW' | 'DIR' | 'ECDH_ES' | 'ECDH_ES_A128KW' | 'ECDH_ES_A192KW' | 'ECDH_ES_A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'PBES2_HS256_A128KW' | 'PBES2_HS384_A192KW' | 'PBES2_HS512_A256KW' nullable

this is the 'alg' header value for encrypted JWT tokens. Depending upon the context, this refers to key transport scheme to be used by the client and by the server. For instance:

  • as authorizationEncryptionAlg value, it refers to the encoding algorithm used by server for transporting they keys on JARM objects
  • as requestEncryptionAlg value, it refers to the expected key transport encoding algorithm that server expect from client when encrypting a Request Object
  • as idTokenEncryptionAlg value, it refers to the algorithm used by the server to key transport of id_tokens

Please note that some of the algorithms are more secure than others, some are not supported very well cross platforms and some (like RSA1_5) is known to be weak.

userInfoEncryptionEnc'A128CBC_HS256' | 'A192CBC_HS384' | 'A256CBC_HS512' | 'A128GCM' | 'A192GCM' | 'A256GCM' nullable

This is the encryption algorithm to be used when encrypting a JWT on client or server side. Depending upon the context, this refers to encryption done by the client or by the server. For instance:

  • as authorizationEncryptionEnc value, it refers to the encryption algorithm used by server when creating a JARM response
  • as requestEncryptionEnc value, it refers to the expected encryption algorithm used by the client when encrypting a Request Object
  • as idTokenEncryptionEnc value, it refers to the algorithm used by the server to encrypt id_tokens
loginUristring

The URL which a third party can use to initiate a login by the client application.

This property corresponds to initiate_login_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

tosUristring

The URL pointing to the "Terms Of Service" page.

This property corresponds to tos_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

policyUristring

The URL pointing to the page which describes the policy as to how end-user's profile data is used.

This property corresponds to policy_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

clientUristring

The URL pointing to the home page of the client application.

This property corresponds to client_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

bcDeliveryModestring

The backchannel token delivery mode.

This property corresponds to the backchannel_token_delivery_mode metadata. The backchannel token delivery mode is defined in the specification of "CIBA (Client Initiated Backchannel Authentication)".

bcNotificationEndpointstring

The backchannel client notification endpoint.

This property corresponds to the backchannel_client_notification_endpoint metadata. The backchannel token delivery mode is defined in the specification of "CIBA (Client Initiated Backchannel Authentication)".

bcRequestSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
bcUserCodeRequiredboolean

The boolean flag to indicate whether a user code is required when this client makes a backchannel authentication request.

This property corresponds to the backchannel_user_code_parameter metadata.

authorizationDetailsTypesstring[]

The authorization details types that this client may use as values of the type field in authorization_details.

This property corresponds to the authorization_details_types metadata. See OAuth 2.0 Rich Authorization Requests (RAR) for details.

Note that the property name was renamed from authorizationDataTypes to authorizationDetailsTypes to align with the change made by the 5th draft of the RAR specification.

customMetadatastring

The custom client metadata in JSON format.

Standard specifications define client metadata as necessary. The following are such examples.

Standard client metadata included in Client Registration Request and Client Update Request (cf. OIDC DynReg, RFC 7591 and RFC 7592) are, if supported by Authlete, set to corresponding properties of the client application. For example, the value of the client_name client metadata in Client Registration/Update Request is set to the clientName property. On the other hand, unrecognized client metadata are discarded.

By listing up custom client metadata in advance by using the supportedCustomClientMetadata property of Service, Authlete can recognize them and stores their values into the database. The stored custom client metadata values can be referenced by this property.

frontChannelRequestObjectEncryptionRequiredboolean

The flag indicating whether encryption of request object is required when the request object is passed through the front channel.

This flag does not affect the processing of request objects at the Pushed Authorization Request Endpoint, which is defined in OAuth 2.0 Pushed Authorization Requests. Unecrypted request objects are accepted at the endpoint even if this flag is true.

This flag does not indicate whether a request object is always required. There is a different flag, requestObjectRequired, for the purpose.

Even if this flag is false, encryption of request object is required if the frontChannelRequestObjectEncryptionRequired flag of the service is true.

requestObjectEncryptionAlgMatchRequiredboolean

The flag indicating whether the JWE alg of encrypted request object must match the request_object_encryption_alg client metadata.

The request_object_encryption_alg client metadata itself is defined in OpenID Connect Dynamic Client Registration 1.0 as follows.

request_object_encryption_alg

OPTIONAL. JWE [JWE] alg algorithm [JWA] the RP is declaring that it may use for encrypting Request Objects sent to the OP. This parameter SHOULD be included when symmetric encryption will be used, since this signals to the OP that a client_secret value needs to be returned from which the symmetric key will be derived, that might not otherwise be returned. The RP MAY still use other supported encryption algorithms or send unencrypted Request Objects, even when this parameter is present. If both signing and encryption are requested, the Request Object will be signed then encrypted, with the result being a Nested JWT, as defined in [JWT]. The default, if omitted, is that the RP is not declaring whether it might encrypt any Request Objects.

The point here is "The RP MAY still use other supported encryption algorithms or send unencrypted Request Objects, even when this parameter is present."

The property that represents the client metadata is requestEncryptionAlg. See the description of requestEncryptionAlg for details.

Even if this flag is false, the match is required if the requestObjectEncryptionAlgMatchRequired flag of the service is true.

requestObjectEncryptionEncMatchRequiredboolean

The flag indicating whether the JWE enc of encrypted request object must match the request_object_encryption_enc client metadata.

The request_object_encryption_enc client metadata itself is defined in OpenID Connect Dynamic Client Registration 1.0 as follows.

request_object_encryption_enc

OPTIONAL. JWE enc algorithm [JWA] the RP is declaring that it may use for encrypting Request Objects sent to the OP. If request_object_encryption_alg is specified, the default for this value is A128CBC-HS256. When request_object_encryption_enc is included, request_object_encryption_alg MUST also be provided.

The property that represents the client metadata is requestEncryptionEnc. See the description of requestEncryptionEnc for details.

Even if this flag is false, the match is required if the requestObjectEncryptionEncMatchRequired flag of the service is true.

digestAlgorithmstring

The digest algorithm that this client requests the server to use when it computes digest values of external attachments, which may be referenced from within ID tokens or userinfo responses (or any place that can have the verified\_claims claim). Possible values are listed in the Hash Algorithm Registry of IANA (Internet Assigned Numbers Authority), but the server does not necessarily support all the values there. When this property is omitted, sha-256 is used as the default algorithm. This property corresponds to the digest\_algorithm client metadata which was defined by the third implementer's draft of OpenID Connect for Identity Assurance 1.0.

singleAccessTokenPerSubjectboolean

If Enabled is selected, an attempt to issue a new access token invalidates existing access tokens that are associated with the same combination of subject and client.

Note that, however, attempts by Client Credentials Flow do not invalidate existing access tokens because access tokens issued by Client Credentials Flow are not associated with any end-user's subject.

Even if Disabled is selected here, single access token per subject is effective if singleAccessTokenPerSubject of the Service this client belongs to is Enabled.

pkceRequiredboolean

The flag to indicate whether the use of Proof Key for Code Exchange (PKCE) is always required for authorization requests by Authorization Code Flow.

If true, code_challenge request parameter is always required for authorization requests using Authorization Code Flow.

See RFC 7636 (Proof Key for Code Exchange by OAuth Public Clients) for details about code_challenge request parameter.

pkceS256Requiredboolean

The flag to indicate whether S256 is always required as the code challenge method whenever PKCE (RFC 7636) is used.

If this flag is set to true, code_challenge_method=S256 must be included in the authorization request whenever it includes the code_challenge request parameter. Neither omission of the code_challenge_method request parameter nor use of plain (code_challenge_method=plain) is allowed.

dpopRequiredboolean

If the DPoP is required for this client

automaticallyRegisteredboolean

The flag indicating whether this client was registered by the "automatic" client registration of OIDC Federation.

explicitlyRegisteredboolean

The flag indicating whether this client was registered by the "explicit" client registration of OIDC Federation.

rsRequestSignedboolean

The flag indicating whether this service signs responses from the resource server.

rsSignedRequestKeyIdstring

The key ID of a JWK containing the public key used by this client to sign requests to the resource server.

clientRegistrationTypesClientRegistrationType[]

The client registration types that the client has declared it may use.

organizationNamestring

The human-readable name representing the organization that manages this client. This property corresponds to the organization_name client metadata that is defined in OpenID Connect Federation 1.0.

signedJwksUristring

The URI of the endpoint that returns this client's JWK Set document in the JWT format. This property corresponds to the signed_jwks_uri client metadata defined in OpenID Connect Federation 1.0.

entityIdstring

the entity ID of this client.

trustAnchorIdstring

The entity ID of the trust anchor of the trust chain that was used when this client was registered or updated by the mechanism defined in OpenID Connect Federation 1.0

trustChainstring[]

The trust chain that was used when this client was registered or updated by the mechanism defined in OpenID Connect Federation 1.0

trustChainExpiresAtinteger

the expiration time of the trust chain that was used when this client was registered or updated by the mechanism defined in OpenID Connect Federation 1.0. The value is represented as milliseconds elapsed since the Unix epoch (1970-01-01).

trustChainUpdatedAtinteger

the time at which the trust chain was updated by the mechanism defined in OpenID Connect Federation 1.0

lockedboolean

The flag which indicates whether this client is locked.

credentialOfferEndpointstring

The URL of the credential offer endpoint at which this client (wallet) receives a credential offer from the credential issuer.

fapiModesFapiMode[]

The FAPI modes for this client.

When the value of this property is not null, Authlete always processes requests from this client based on the specified FAPI modes if the FAPI feature is enabled in Authlete, the FAPI profile is supported by the service, and the FAPI modes for the service are set to null.

For instance, when this property is set to an array containing FAPI1_ADVANCED only, Authlete always processes requests from this client based on "Financial-grade API Security Profile 1.0 - Part 2: Advanced" if the FAPI feature is enabled in Authlete, the FAPI profile is supported by the service, and the FAPI modes for the service are set to null.

responseModesstring[]

The response modes that this client may use.

credentialResponseEncryptionRequiredboolean

True if credential responses to this client must be always encrypted.

mtlsEndpointAliasesUsedboolean

The flag indicating whether the client intends to prefer mutual TLS endpoints over non-MTLS endpoints.

This property corresponds to the use_mtls_endpoint_aliases client metadata that is defined in FAPI 2.0 Security Profile, 8.1.1. use_mtls_endpoint_aliases.

inScopeForTokenMigrationboolean

The flag indicating whether this client is in scope for token migration operations.

metadataDocumentLocationstring uri

Location of the Client ID Metadata Document that was used for this client.

metadataDocumentExpiresAtinteger

Expiration time of the metadata document (UNIX time in milliseconds).

metadataDocumentUpdatedAtinteger

Last-updated time of the metadata document (UNIX time in milliseconds).

discoveredByMetadataDocumentboolean

Indicates whether this client was discovered via a Client ID Metadata Document.

clientSource'DYNAMIC_REGISTRATION' | 'AUTOMATIC_REGISTRATION' | 'EXPLICIT_REGISTRATION' | 'METADATA_DOCUMENT' | 'STATIC_REGISTRATION'

Source of this client record.

Example request

{
  "number": 1140735077,
  "serviceNumber": 715948317,
  "clientName": "My Test Client",
  "clientId": "1140735077",
  "clientSecret": "gXz97ISgLs4HuXwOZWch8GEmgL4YMvUJwu3er_kDVVGcA0UOhA9avLPbEmoeZdagi9yC_-tEiT2BdRyH9dbrQQ",
  "clientType": "PUBLIC",
  "redirectUris": [
    "https://example.com/callback"
  ],
  "responseTypes": [
    "CODE"
  ],
  "grantTypes": [
    "AUTHORIZATION_CODE"
  ]
}

Response

Client created successfully (legacy compatibility)

numberinteger

The sequential number of the client. The value of this property is assigned by Authlete.

serviceNumberinteger

The sequential number of the service of the client application. The value of this property is assigned by Authlete.

clientNamestring

The name of the client application. This property corresponds to client_name in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

descriptionstring

The description about the client application.

clientIdinteger

The client identifier used in Authlete API calls. The value of this property is assigned by Authlete.

clientSecretstring

The client secret. A random 512-bit value encoded by base64url (86 letters). The value of this property is assigned by Authlete.

Note that Authlete issues a client secret even to a "public" client application, but the client application should not use the client secret unless it changes its client type to "confidential". That is, a public client application should behave as if it had not been issued a client secret. To be specific, a token request from a public client of Authlete should not come along with a client secret although RFC 6749, 3.2.1. Client Authentication says as follows.

Confidential clients or other clients issued client credentials MUST authenticate with the authorization server as described in Section 2.3 when making requests to the token endpoint.

clientIdAliasstring

The value of the client's client_id property used in OAuth and OpenID Connect calls. By default, this is a string version of the clientId property.

clientIdAliasEnabledboolean

Deprecated. Always set to true.

clientType'PUBLIC' | 'CONFIDENTIAL'

The client type, either CONFIDENTIAL or PUBLIC. See RFC 6749, 2.1. Client Types for details.

applicationType'WEB' | 'NATIVE'

The application type. The value of this property affects the validation steps for a redirect URI. See the description about redirectUris property for more details.

logoUristring

The URL pointing to the logo image of the client application.

This property corresponds to logo_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

contactsstring[]

An array of email addresses of people responsible for the client application.

This property corresponds to contacts in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

tlsClientCertificateBoundAccessTokensboolean

The flag to indicate whether this client use TLS client certificate bound access tokens.

dynamicallyRegisteredboolean

The flag to indicate whether this client has been registered dynamically. For more details, see RFC 7591.

softwareIdstring

The unique identifier string assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.

This property corresponds to the software_id metadata defined in 2. Client Metadata of RFC 7591.

developerstring

The unique identifier of the developer who created this client application.

softwareVersionstring

The version identifier string for the client software identified by the software ID.

This property corresponds to the software_version metadata defined in 2. Client Metadata of RFC 7591.

registrationAccessTokenHashstring

The hash of the registration access token for this client.

createdAtinteger

The time at which this client was created. The value is represented as milliseconds since the UNIX epoch (1970-01-01).

modifiedAtinteger

The time at which this client was last modified. The value is represented as milliseconds since the UNIX epoch (1970-01-01).

grantTypesGrantType[]

A string array of grant types which the client application declares that it will restrict itself to using. This property corresponds to grant_types in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

responseTypesResponseType[]

A string array of response types which the client application declares that it will restrict itself to using. This property corresponds to response_types in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

redirectUrisstring[]

Redirect URIs that the client application uses to receive a response from the authorization endpoint. Requirements for a redirect URI are as follows.

Requirements by RFC 6749 (From RFC 6749, 3.1.2. Redirection Endpoint)

  • Must be an absolute URI.
  • Must not have a fragment component.

Requirements by OpenID Connect (From "OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata, application_type")

  • The scheme of the redirect URI used for Implicit Grant by a client application whose application is web must be https. This is checked at runtime by Authlete.
  • The hostname of the redirect URI used for Implicit Grant by a client application whose application type is web must not be localhost. This is checked at runtime by Authlete.
  • The scheme of the redirect URI used by a client application whose application type is native must be either (1) a custom scheme or (2) http, which is allowed only when the hostname part is localhost. This is checked at runtime by Authlete.

Requirements by Authlete

  • Must consist of printable ASCII letters only.
  • Must not exceed 200 letters.

Note that Authlete allows the application type to be null. In other words, a client application does not have to choose web or native as its application type. If the application type is null, the requirements by OpenID Connect are not checked at runtime.

An authorization request from a client application which has not registered any redirect URI fails unless at least all the following conditions are satisfied.

  • The client type of the client application is confidential.
  • The value of response_type request parameter is code.
  • The authorization request has the redirect_uri request parameter.
  • The value of scope request parameter does not contain openid.

RFC 6749 allows partial match of redirect URI under some conditions (see RFC 6749, 3.1.2.2. Registration Requirements for details), but OpenID Connect requires exact match.

authorizationSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
authorizationEncryptionAlg'RSA1_5' | 'RSA_OAEP' | 'RSA_OAEP_256' | 'A128KW' | 'A192KW' | 'A256KW' | 'DIR' | 'ECDH_ES' | 'ECDH_ES_A128KW' | 'ECDH_ES_A192KW' | 'ECDH_ES_A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'PBES2_HS256_A128KW' | 'PBES2_HS384_A192KW' | 'PBES2_HS512_A256KW' nullable

this is the 'alg' header value for encrypted JWT tokens. Depending upon the context, this refers to key transport scheme to be used by the client and by the server. For instance:

  • as authorizationEncryptionAlg value, it refers to the encoding algorithm used by server for transporting they keys on JARM objects
  • as requestEncryptionAlg value, it refers to the expected key transport encoding algorithm that server expect from client when encrypting a Request Object
  • as idTokenEncryptionAlg value, it refers to the algorithm used by the server to key transport of id_tokens

Please note that some of the algorithms are more secure than others, some are not supported very well cross platforms and some (like RSA1_5) is known to be weak.

authorizationEncryptionEnc'A128CBC_HS256' | 'A192CBC_HS384' | 'A256CBC_HS512' | 'A128GCM' | 'A192GCM' | 'A256GCM' nullable

This is the encryption algorithm to be used when encrypting a JWT on client or server side. Depending upon the context, this refers to encryption done by the client or by the server. For instance:

  • as authorizationEncryptionEnc value, it refers to the encryption algorithm used by server when creating a JARM response
  • as requestEncryptionEnc value, it refers to the expected encryption algorithm used by the client when encrypting a Request Object
  • as idTokenEncryptionEnc value, it refers to the algorithm used by the server to encrypt id_tokens
tokenAuthMethod'NONE' | 'CLIENT_SECRET_BASIC' | 'CLIENT_SECRET_POST' | 'CLIENT_SECRET_JWT' | 'PRIVATE_KEY_JWT' | 'TLS_CLIENT_AUTH' | 'SELF_SIGNED_TLS_CLIENT_AUTH' | 'ATTEST_JWT_CLIENT_AUTH'

The client authentication method that the client application declares that it uses at the token endpoint. This property corresponds to token_endpoint_auth_method in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

tokenAuthSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
selfSignedCertificateKeyIdstring

The key ID of a JWK containing a self-signed certificate of this client.

tlsClientAuthSubjectDnstring

The string representation of the expected subject distinguished name of the certificate this client will use in mutual TLS authentication.

See tls_client_auth_subject_dn in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details.

tlsClientAuthSanDnsstring

The string representation of the expected DNS subject alternative name of the certificate this client will use in mutual TLS authentication.

See tls_client_auth_san_dns in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details.

tlsClientAuthSanUristring

The string representation of the expected URI subject alternative name of the certificate this client will use in mutual TLS authentication.

See tls_client_auth_san_uri in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details.

tlsClientAuthSanIpstring

The string representation of the expected IP address subject alternative name of the certificate this client will use in mutual TLS authentication.

See tls_client_auth_san_ip in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details.

tlsClientAuthSanEmailstring

The string representation of the expected email address subject alternative name of the certificate this client will use in mutual TLS authentication.

See tls_client_auth_san_email in "Mutual TLS Profiles for OAuth Clients, 2.3. Dynamic Client Registration" for details.

parRequiredboolean

The flag to indicate whether this client is required to use the pushed authorization request endpoint. This property corresponds to the require_pushed_authorization_requests client metadata defined in "OAuth 2.0 Pushed Authorization Requests".

requestObjectRequiredboolean

The flag to indicate whether authorization requests from this client are always required to utilize a request object by using either request or request_uri request parameter.

If this flag is set to true and the service's traditionalRequestObjectProcessingApplied is set to false, authorization requests from this client are processed as if require_signed_request_object client metadata of this client is true. The metadata is defined in "JAR (JWT Secured Authorization Request)".

requestSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
requestEncryptionAlg'RSA1_5' | 'RSA_OAEP' | 'RSA_OAEP_256' | 'A128KW' | 'A192KW' | 'A256KW' | 'DIR' | 'ECDH_ES' | 'ECDH_ES_A128KW' | 'ECDH_ES_A192KW' | 'ECDH_ES_A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'PBES2_HS256_A128KW' | 'PBES2_HS384_A192KW' | 'PBES2_HS512_A256KW' nullable

this is the 'alg' header value for encrypted JWT tokens. Depending upon the context, this refers to key transport scheme to be used by the client and by the server. For instance:

  • as authorizationEncryptionAlg value, it refers to the encoding algorithm used by server for transporting they keys on JARM objects
  • as requestEncryptionAlg value, it refers to the expected key transport encoding algorithm that server expect from client when encrypting a Request Object
  • as idTokenEncryptionAlg value, it refers to the algorithm used by the server to key transport of id_tokens

Please note that some of the algorithms are more secure than others, some are not supported very well cross platforms and some (like RSA1_5) is known to be weak.

requestEncryptionEnc'A128CBC_HS256' | 'A192CBC_HS384' | 'A256CBC_HS512' | 'A128GCM' | 'A192GCM' | 'A256GCM' nullable

This is the encryption algorithm to be used when encrypting a JWT on client or server side. Depending upon the context, this refers to encryption done by the client or by the server. For instance:

  • as authorizationEncryptionEnc value, it refers to the encryption algorithm used by server when creating a JARM response
  • as requestEncryptionEnc value, it refers to the expected encryption algorithm used by the client when encrypting a Request Object
  • as idTokenEncryptionEnc value, it refers to the algorithm used by the server to encrypt id_tokens
requestUrisstring[]

An array of URLs each of which points to a request object.

Authlete requires that URLs used as values for request_uri request parameter be pre-registered. This property is used for the pre-registration. See OpenID Connect Core 1.0, 6.2. Passing a Request Object by Reference for details.

defaultMaxAgeinteger

The default maximum authentication age in seconds. This value is used when an authorization request from the client application does not have max_age request parameter.

This property corresponds to default_max_age in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

defaultAcrsstring[]

The default ACRs (Authentication Context Class References). This value is used when an authorization request from the client application has neither acr_values request parameter nor acr claim in claims request parameter.

idTokenSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
idTokenEncryptionAlg'RSA1_5' | 'RSA_OAEP' | 'RSA_OAEP_256' | 'A128KW' | 'A192KW' | 'A256KW' | 'DIR' | 'ECDH_ES' | 'ECDH_ES_A128KW' | 'ECDH_ES_A192KW' | 'ECDH_ES_A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'PBES2_HS256_A128KW' | 'PBES2_HS384_A192KW' | 'PBES2_HS512_A256KW' nullable

this is the 'alg' header value for encrypted JWT tokens. Depending upon the context, this refers to key transport scheme to be used by the client and by the server. For instance:

  • as authorizationEncryptionAlg value, it refers to the encoding algorithm used by server for transporting they keys on JARM objects
  • as requestEncryptionAlg value, it refers to the expected key transport encoding algorithm that server expect from client when encrypting a Request Object
  • as idTokenEncryptionAlg value, it refers to the algorithm used by the server to key transport of id_tokens

Please note that some of the algorithms are more secure than others, some are not supported very well cross platforms and some (like RSA1_5) is known to be weak.

idTokenEncryptionEnc'A128CBC_HS256' | 'A192CBC_HS384' | 'A256CBC_HS512' | 'A128GCM' | 'A192GCM' | 'A256GCM' nullable

This is the encryption algorithm to be used when encrypting a JWT on client or server side. Depending upon the context, this refers to encryption done by the client or by the server. For instance:

  • as authorizationEncryptionEnc value, it refers to the encryption algorithm used by server when creating a JARM response
  • as requestEncryptionEnc value, it refers to the expected encryption algorithm used by the client when encrypting a Request Object
  • as idTokenEncryptionEnc value, it refers to the algorithm used by the server to encrypt id_tokens
authTimeRequiredboolean

The flag to indicate whether this client requires auth_time claim to be embedded in the ID token.

This property corresponds to require_auth_time in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

subjectType'PUBLIC' | 'PAIRWISE'

The subject type that the client application requests. Details about the subject type are described in OpenID Connect Core 1.0, 8. Subjct Identifier Types.

This property corresponds to subject_type in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

sectorIdentifierUristring

The value of the sector identifier URI. This represents the sector_identifier_uri client metadata which is defined in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata

derivedSectorIdentifierstring

The sector identifier host component as derived from either the sector_identifier_uri or the registered redirect URI. If no sector_identifier_uri is registered and multiple redirect URIs are also registered, the value of this property is null.

jwksUristring

The URL pointing to the JWK Set of the client application. The content pointed to by the URL is JSON which complies with the format described in JSON Web Key (JWK), 5. JWK Set Format. The JWK Set must not include private keys of the client application.

If the client application requests encryption for ID tokens (from the authorization/token/userinfo endpoints) and/or signs request objects, it must make available its JWK Set containing public keys for the encryption and/or the signature at the URL of jwksUri. The service (Authlete) fetches the JWK Set from the URL as necessary.

OpenID Connect Dynamic Client Registration 1.0 says that jwks must not be used when the client can use jwks_uri, but Authlete allows both properties to be registered at the same time. However, Authlete does not use the content of jwks when jwksUri is registered.

This property corresponds to jwks_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

jwksstring

The content of the JWK Set of the client application. The format is described in JSON Web Key (JWK), 5. JWK Set Format. The JWK Set must not include private keys of the client application.

OpenID Connect Dynamic Client Registration 1.0 says that jwks must not be used when the client can use jwks_uri, but Authlete allows both properties to be registered at the same time. However, Authlete does not use the content of jwks when jwksUri is registered.

This property corresponds to jwks_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

userInfoSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
userInfoEncryptionAlg'RSA1_5' | 'RSA_OAEP' | 'RSA_OAEP_256' | 'A128KW' | 'A192KW' | 'A256KW' | 'DIR' | 'ECDH_ES' | 'ECDH_ES_A128KW' | 'ECDH_ES_A192KW' | 'ECDH_ES_A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'PBES2_HS256_A128KW' | 'PBES2_HS384_A192KW' | 'PBES2_HS512_A256KW' nullable

this is the 'alg' header value for encrypted JWT tokens. Depending upon the context, this refers to key transport scheme to be used by the client and by the server. For instance:

  • as authorizationEncryptionAlg value, it refers to the encoding algorithm used by server for transporting they keys on JARM objects
  • as requestEncryptionAlg value, it refers to the expected key transport encoding algorithm that server expect from client when encrypting a Request Object
  • as idTokenEncryptionAlg value, it refers to the algorithm used by the server to key transport of id_tokens

Please note that some of the algorithms are more secure than others, some are not supported very well cross platforms and some (like RSA1_5) is known to be weak.

userInfoEncryptionEnc'A128CBC_HS256' | 'A192CBC_HS384' | 'A256CBC_HS512' | 'A128GCM' | 'A192GCM' | 'A256GCM' nullable

This is the encryption algorithm to be used when encrypting a JWT on client or server side. Depending upon the context, this refers to encryption done by the client or by the server. For instance:

  • as authorizationEncryptionEnc value, it refers to the encryption algorithm used by server when creating a JARM response
  • as requestEncryptionEnc value, it refers to the expected encryption algorithm used by the client when encrypting a Request Object
  • as idTokenEncryptionEnc value, it refers to the algorithm used by the server to encrypt id_tokens
loginUristring

The URL which a third party can use to initiate a login by the client application.

This property corresponds to initiate_login_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

tosUristring

The URL pointing to the "Terms Of Service" page.

This property corresponds to tos_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

policyUristring

The URL pointing to the page which describes the policy as to how end-user's profile data is used.

This property corresponds to policy_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

clientUristring

The URL pointing to the home page of the client application.

This property corresponds to client_uri in OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata.

bcDeliveryModestring

The backchannel token delivery mode.

This property corresponds to the backchannel_token_delivery_mode metadata. The backchannel token delivery mode is defined in the specification of "CIBA (Client Initiated Backchannel Authentication)".

bcNotificationEndpointstring

The backchannel client notification endpoint.

This property corresponds to the backchannel_client_notification_endpoint metadata. The backchannel token delivery mode is defined in the specification of "CIBA (Client Initiated Backchannel Authentication)".

bcRequestSignAlg'NONE' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512' | 'ES256K' | 'EdDSA' nullable

The signature algorithm for JWT. This value is represented on 'alg' attribute of the header of JWT.

it's semantics depends upon where is this defined, for instance:

  • as service accessTokenSignAlg value, it defines that access token are JWT and the algorithm used to sign it. Check your KB article.
  • as client authorizationSignAlg value, it represents the signature algorithm used when creating a JARM response.
  • or as client requestSignAlg value, it specifies which is the expected signature used by client on a Request Object.
bcUserCodeRequiredboolean

The boolean flag to indicate whether a user code is required when this client makes a backchannel authentication request.

This property corresponds to the backchannel_user_code_parameter metadata.

authorizationDetailsTypesstring[]

The authorization details types that this client may use as values of the type field in authorization_details.

This property corresponds to the authorization_details_types metadata. See OAuth 2.0 Rich Authorization Requests (RAR) for details.

Note that the property name was renamed from authorizationDataTypes to authorizationDetailsTypes to align with the change made by the 5th draft of the RAR specification.

customMetadatastring

The custom client metadata in JSON format.

Standard specifications define client metadata as necessary. The following are such examples.

Standard client metadata included in Client Registration Request and Client Update Request (cf. OIDC DynReg, RFC 7591 and RFC 7592) are, if supported by Authlete, set to corresponding properties of the client application. For example, the value of the client_name client metadata in Client Registration/Update Request is set to the clientName property. On the other hand, unrecognized client metadata are discarded.

By listing up custom client metadata in advance by using the supportedCustomClientMetadata property of Service, Authlete can recognize them and stores their values into the database. The stored custom client metadata values can be referenced by this property.

frontChannelRequestObjectEncryptionRequiredboolean

The flag indicating whether encryption of request object is required when the request object is passed through the front channel.

This flag does not affect the processing of request objects at the Pushed Authorization Request Endpoint, which is defined in OAuth 2.0 Pushed Authorization Requests. Unecrypted request objects are accepted at the endpoint even if this flag is true.

This flag does not indicate whether a request object is always required. There is a different flag, requestObjectRequired, for the purpose.

Even if this flag is false, encryption of request object is required if the frontChannelRequestObjectEncryptionRequired flag of the service is true.

requestObjectEncryptionAlgMatchRequiredboolean

The flag indicating whether the JWE alg of encrypted request object must match the request_object_encryption_alg client metadata.

The request_object_encryption_alg client metadata itself is defined in OpenID Connect Dynamic Client Registration 1.0 as follows.

request_object_encryption_alg

OPTIONAL. JWE [JWE] alg algorithm [JWA] the RP is declaring that it may use for encrypting Request Objects sent to the OP. This parameter SHOULD be included when symmetric encryption will be used, since this signals to the OP that a client_secret value needs to be returned from which the symmetric key will be derived, that might not otherwise be returned. The RP MAY still use other supported encryption algorithms or send unencrypted Request Objects, even when this parameter is present. If both signing and encryption are requested, the Request Object will be signed then encrypted, with the result being a Nested JWT, as defined in [JWT]. The default, if omitted, is that the RP is not declaring whether it might encrypt any Request Objects.

The point here is "The RP MAY still use other supported encryption algorithms or send unencrypted Request Objects, even when this parameter is present."

The property that represents the client metadata is requestEncryptionAlg. See the description of requestEncryptionAlg for details.

Even if this flag is false, the match is required if the requestObjectEncryptionAlgMatchRequired flag of the service is true.

requestObjectEncryptionEncMatchRequiredboolean

The flag indicating whether the JWE enc of encrypted request object must match the request_object_encryption_enc client metadata.

The request_object_encryption_enc client metadata itself is defined in OpenID Connect Dynamic Client Registration 1.0 as follows.

request_object_encryption_enc

OPTIONAL. JWE enc algorithm [JWA] the RP is declaring that it may use for encrypting Request Objects sent to the OP. If request_object_encryption_alg is specified, the default for this value is A128CBC-HS256. When request_object_encryption_enc is included, request_object_encryption_alg MUST also be provided.

The property that represents the client metadata is requestEncryptionEnc. See the description of requestEncryptionEnc for details.

Even if this flag is false, the match is required if the requestObjectEncryptionEncMatchRequired flag of the service is true.

digestAlgorithmstring

The digest algorithm that this client requests the server to use when it computes digest values of external attachments, which may be referenced from within ID tokens or userinfo responses (or any place that can have the verified\_claims claim). Possible values are listed in the Hash Algorithm Registry of IANA (Internet Assigned Numbers Authority), but the server does not necessarily support all the values there. When this property is omitted, sha-256 is used as the default algorithm. This property corresponds to the digest\_algorithm client metadata which was defined by the third implementer's draft of OpenID Connect for Identity Assurance 1.0.

singleAccessTokenPerSubjectboolean

If Enabled is selected, an attempt to issue a new access token invalidates existing access tokens that are associated with the same combination of subject and client.

Note that, however, attempts by Client Credentials Flow do not invalidate existing access tokens because access tokens issued by Client Credentials Flow are not associated with any end-user's subject.

Even if Disabled is selected here, single access token per subject is effective if singleAccessTokenPerSubject of the Service this client belongs to is Enabled.

pkceRequiredboolean

The flag to indicate whether the use of Proof Key for Code Exchange (PKCE) is always required for authorization requests by Authorization Code Flow.

If true, code_challenge request parameter is always required for authorization requests using Authorization Code Flow.

See RFC 7636 (Proof Key for Code Exchange by OAuth Public Clients) for details about code_challenge request parameter.

pkceS256Requiredboolean

The flag to indicate whether S256 is always required as the code challenge method whenever PKCE (RFC 7636) is used.

If this flag is set to true, code_challenge_method=S256 must be included in the authorization request whenever it includes the code_challenge request parameter. Neither omission of the code_challenge_method request parameter nor use of plain (code_challenge_method=plain) is allowed.

dpopRequiredboolean

If the DPoP is required for this client

automaticallyRegisteredboolean

The flag indicating whether this client was registered by the "automatic" client registration of OIDC Federation.

explicitlyRegisteredboolean

The flag indicating whether this client was registered by the "explicit" client registration of OIDC Federation.

rsRequestSignedboolean

The flag indicating whether this service signs responses from the resource server.

rsSignedRequestKeyIdstring

The key ID of a JWK containing the public key used by this client to sign requests to the resource server.

clientRegistrationTypesClientRegistrationType[]

The client registration types that the client has declared it may use.

organizationNamestring

The human-readable name representing the organization that manages this client. This property corresponds to the organization_name client metadata that is defined in OpenID Connect Federation 1.0.

signedJwksUristring

The URI of the endpoint that returns this client's JWK Set document in the JWT format. This property corresponds to the signed_jwks_uri client metadata defined in OpenID Connect Federation 1.0.

entityIdstring

the entity ID of this client.

trustAnchorIdstring

The entity ID of the trust anchor of the trust chain that was used when this client was registered or updated by the mechanism defined in OpenID Connect Federation 1.0

trustChainstring[]

The trust chain that was used when this client was registered or updated by the mechanism defined in OpenID Connect Federation 1.0

trustChainExpiresAtinteger

the expiration time of the trust chain that was used when this client was registered or updated by the mechanism defined in OpenID Connect Federation 1.0. The value is represented as milliseconds elapsed since the Unix epoch (1970-01-01).

trustChainUpdatedAtinteger

the time at which the trust chain was updated by the mechanism defined in OpenID Connect Federation 1.0

lockedboolean

The flag which indicates whether this client is locked.

credentialOfferEndpointstring

The URL of the credential offer endpoint at which this client (wallet) receives a credential offer from the credential issuer.

fapiModesFapiMode[]

The FAPI modes for this client.

When the value of this property is not null, Authlete always processes requests from this client based on the specified FAPI modes if the FAPI feature is enabled in Authlete, the FAPI profile is supported by the service, and the FAPI modes for the service are set to null.

For instance, when this property is set to an array containing FAPI1_ADVANCED only, Authlete always processes requests from this client based on "Financial-grade API Security Profile 1.0 - Part 2: Advanced" if the FAPI feature is enabled in Authlete, the FAPI profile is supported by the service, and the FAPI modes for the service are set to null.

responseModesstring[]

The response modes that this client may use.

credentialResponseEncryptionRequiredboolean

True if credential responses to this client must be always encrypted.

mtlsEndpointAliasesUsedboolean

The flag indicating whether the client intends to prefer mutual TLS endpoints over non-MTLS endpoints.

This property corresponds to the use_mtls_endpoint_aliases client metadata that is defined in FAPI 2.0 Security Profile, 8.1.1. use_mtls_endpoint_aliases.

inScopeForTokenMigrationboolean

The flag indicating whether this client is in scope for token migration operations.

metadataDocumentLocationstring uri

Location of the Client ID Metadata Document that was used for this client.

metadataDocumentExpiresAtinteger

Expiration time of the metadata document (UNIX time in milliseconds).

metadataDocumentUpdatedAtinteger

Last-updated time of the metadata document (UNIX time in milliseconds).

discoveredByMetadataDocumentboolean

Indicates whether this client was discovered via a Client ID Metadata Document.

clientSource'DYNAMIC_REGISTRATION' | 'AUTOMATIC_REGISTRATION' | 'EXPLICIT_REGISTRATION' | 'METADATA_DOCUMENT' | 'STATIC_REGISTRATION'

Source of this client record.

Example response

{
  "number": 1140735077,
  "serviceNumber": 715948317,
  "clientName": "My Test Client",
  "clientId": "1140735077",
  "clientSecret": "gXz97ISgLs4HuXwOZWch8GEmgL4YMvUJwu3er_kDVVGcA0UOhA9avLPbEmoeZdagi9yC_-tEiT2BdRyH9dbrQQ",
  "clientType": "PUBLIC",
  "redirectUris": [
    "https://example.com/callback"
  ],
  "responseTypes": [
    "CODE"
  ],
  "grantTypes": [
    "AUTHORIZATION_CODE"
  ]
}

Changes