---
title: "Register a third-party OAuth client"
method: POST
path: "/workspaces/{workspace_id}/oauth-clients"
tags: ["OAuth Clients"]
---

# Register a third-party OAuth client

`POST /workspaces/{workspace_id}/oauth-clients`

## Request

- Base URL: `https://app.mammoth.io/api/v2`
- URL: `https://app.mammoth.io/api/v2/workspaces/{workspace_id}/oauth-clients`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-KEY` and API key in header `X-API-SECRET` and API key in header `X-WORKSPACE-ID`

Registers an OAuth client (authorization-code + PKCE only) for a workspace: confidential by default, or public with token_endpoint_auth_method none. The client secret is returned once, and a public client has none.

## Path parameters

- `workspace_id` integer, required: Workspace refers to a collection of projects. Workspace ID is unique identifier for workspace.

## Request body

- OAuthClientCreate: Details of the OAuth client to register
  - `name` string, required: Name of the OAuth client
  - `description` string, nullable: Description of the OAuth client
  - `redirect_uris` string[], required: Allowed OAuth redirect URIs for this client
  - `logo_url` string, nullable: https:// URL of the client's logo, shown on the consent screen
  - `tos_url` string, nullable: https:// URL of the client's terms of service
  - `privacy_url` string, nullable: https:// URL of the client's privacy policy
  - `token_endpoint_auth_method` 'client_secret_basic' | 'none': client_secret_basic (confidential, default) or none (a public client: PKCE only, no secret, loopback redirect URIs allowed)

## Response `201`

Successful create

- OAuthClientCreateResponse
  - `id` integer, required
  - `client_id` string, required: Public OAuth client_id
  - `name` string, required: Name of the OAuth client
  - `description` string, nullable: Description of the OAuth client
  - `redirect_uris` string[], required: Allowed OAuth redirect URIs for this client
  - `workspace_id` integer, required: Workspace ID the OAuth client is registered under
  - `user_id` integer, required: ID of the user who registered the OAuth client
  - `logo_url` string, nullable: https:// URL of the client's logo, shown on the consent screen
  - `tos_url` string, nullable: https:// URL of the client's terms of service
  - `privacy_url` string, nullable: https:// URL of the client's privacy policy
  - `token_endpoint_auth_method` string, required: client_secret_basic (confidential, default) or none (a public client: PKCE only, no secret, loopback redirect URIs allowed)
  - `created_at` string, date-time, required: When the OAuth client was registered
  - `client_secret` string, nullable: The client secret. Returned exactly once, at creation — only its SHA-256 digest is stored, so it cannot be retrieved again. Absent for a public client (token_endpoint_auth_method none).

## Other responses

- `400`: Bad Request
- `401`: Authorization error
- `403`: Request forbidden -- authorization will not help

---

[API](https://skmtc.dev/mammoth/apis/mammoth-analytics.md) · [All operations](https://skmtc.dev/mammoth/apis/mammoth-analytics/llms.txt) · [OpenAPI document](https://skmtc.dev/mammoth/apis/mammoth-analytics/revisions/fe078afe239b?raw)