OAuth Clients

Register a third-party OAuth client

Registers an OAuth client (authorization-code + PKCE only) for a workspace: confidential by default, or public with token_endpoint_auth_method none. The client secret is returned once, and a public client has none.

post/workspaces/{workspace_id}/oauth-clients

Request

  • Base URL: https://app.mammoth.io/api/v2
  • URL: https://app.mammoth.io/api/v2/workspaces/{workspace_id}/oauth-clients
  • Auth: one of:
    • HTTP bearer
    • API key in header X-API-KEY and API key in header X-API-SECRET and API key in header X-WORKSPACE-ID

Path parameters

workspace_idinteger required

Workspace refers to a collection of projects. Workspace ID is unique identifier for workspace.

Example:4

Request body

namestring required

Name of the OAuth client

descriptionstring nullable

Description of the OAuth client

redirect_urisstring[] required

Allowed OAuth redirect URIs for this client

logo_urlstring nullable

https:// URL of the client's logo, shown on the consent screen

tos_urlstring nullable

https:// URL of the client's terms of service

privacy_urlstring nullable

https:// URL of the client's privacy policy

token_endpoint_auth_method'client_secret_basic' | 'none'

client_secret_basic (confidential, default) or none (a public client: PKCE only, no secret, loopback redirect URIs allowed)

Example request

{
  "name": "Example Integration",
  "description": "Third-party integration example",
  "redirect_uris": [
    "https://example-integration.com/oauth/callback"
  ]
}

Response

Successful create

idinteger required
client_idstring required

Public OAuth client_id

namestring required

Name of the OAuth client

descriptionstring nullable

Description of the OAuth client

redirect_urisstring[] required

Allowed OAuth redirect URIs for this client

workspace_idinteger required

Workspace ID the OAuth client is registered under

user_idinteger required

ID of the user who registered the OAuth client

logo_urlstring nullable

https:// URL of the client's logo, shown on the consent screen

tos_urlstring nullable

https:// URL of the client's terms of service

privacy_urlstring nullable

https:// URL of the client's privacy policy

token_endpoint_auth_methodstring required

client_secret_basic (confidential, default) or none (a public client: PKCE only, no secret, loopback redirect URIs allowed)

created_atstring date-time required

When the OAuth client was registered

client_secretstring nullable

The client secret. Returned exactly once, at creation — only its SHA-256 digest is stored, so it cannot be retrieved again. Absent for a public client (token_endpoint_auth_method none).

Changes

No recorded changes to this operation across all 4 revisions of this API.