---
title: "Create"
method: POST
path: "/v1/connected_apps/clients"
tags: ["Connected Apps"]
---

# Create

`POST /v1/connected_apps/clients`

## Request

- Base URL: `https://api.stytch.com`
- URL: `https://api.stytch.com/v1/connected_apps/clients`
- Auth: HTTP basic

Creates a new Connected App. If the Connected App `client_type` is `first_party` or `third_party` a `client_secret` is returned.

**Important:** This is the only time you will be able to view the generated `client_secret` in the API response. Stytch stores a hash of the `client_secret` and cannot recover the value if lost. Be sure to persist the `client_secret` in a secure location. If the `client_secret` is lost, you will need to trigger a secret rotation flow to receive another one.

## Request body

- ApiConnectedappsV1ConnectedAppsClientsCreateRequest: Request type
  - `client_type` 'first_party' | 'first_party_public' | 'third_party' | 'third_party_public', required
  - `client_name` string: A human-readable name for the client.
  - `client_description` string: A human-readable description for the client.
  - `redirect_urls` string[]: Array of redirect URI values for use in OAuth Authorization flows.
  - `full_access_allowed` boolean: Valid for first party clients only. If `true`, an authorization token granted to this Client can be exchanged for a full Stytch session.
  - `access_token_expiry_minutes` integer: The number of minutes before the access token expires. The default is 60 minutes.
  - `access_token_custom_audience` string: The custom audience for the access token.
  - `access_token_template_content` string: The content of the access token custom claims template. The template must be a valid JSON object.
  - `post_logout_redirect_urls` string[]: Array of redirect URI values for use in OIDC Logout flows.
  - `logo_url` string: The logo URL of the Connected App, if any.
  - `bypass_consent_for_offline_access` boolean: Valid for first party clients only. If true, the client does not need to request explicit user consent for the `offline_access` scope.
  - `id_token_template_content` string

## Response `200`

Successful response

- ApiConnectedappsV1ConnectedAppsClientsCreateResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `connected_app` ApiConnectedappsV1ConnectedAppWithClientSecret, required
    - `client_id` string, required: The ID of the Connected App client.
    - `client_name` string, required: A human-readable name for the client.
    - `client_description` string, required: A human-readable description for the client.
    - `status` string, required
    - `full_access_allowed` boolean, required: Valid for first party clients only. If `true`, an authorization token granted to this Client can be exchanged for a full Stytch session.
    - `client_type` string, required: The type of Connected App. Supported values are `first_party`, `first_party_public`, `third_party`, and `third_party_public`.
    - `redirect_urls` string[], required: Array of redirect URI values for use in OAuth Authorization flows.
    - `access_token_expiry_minutes` integer, required
    - `access_token_template_content` string, required
    - `post_logout_redirect_urls` string[], required: Array of redirect URI values for use in OIDC Logout flows.
    - `bypass_consent_for_offline_access` boolean, required: Valid for first party clients only. If true, the client does not need to request explicit user consent for the `offline_access` scope.
    - `id_token_template_content` string, required
    - `client_secret_last_four` string: The last four characters of the client secret.
    - `next_client_secret_last_four` string: The last four characters of the `next_client_secret`. Null if no `next_client_secret` exists.
    - `client_secret` string: The secret of the Connected App client. **Required for confidential clients**
    - `access_token_custom_audience` string
    - `logo_url` string: The logo URL of the Connected App, if any.
    - `client_id_metadata_url` string
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-06-24** `53efe07dcf8f`: 2 info
  - added the new optional request property `id_token_template_content`
  - added the required property `connected_app/id_token_template_content` to the response with the `200` status
- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2025-09-24** `d1a2040cf009`: 1 info
  - added the optional property `connected_app/client_id_metadata_url` to the response with the `200` status
- **2025-09-17** `8270cf3a3d4c`: 3 info
  - added the media type `application/json` for the response with the status `401`
  - added the media type `application/json` for the response with the status `500`
  - added the non-success response with the status `429`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/connected_apps/clients/post.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)