---
title: "Create"
method: POST
path: "/v1/m2m/clients"
tags: ["M2M"]
---

# Create

`POST /v1/m2m/clients`

## Request

- Base URL: `https://api.stytch.com`
- URL: `https://api.stytch.com/v1/m2m/clients`
- Auth: HTTP basic

Creates a new M2M Client. On initial client creation, you may pass in a custom `client_id` or `client_secret` to import an existing M2M client. If you do not pass in a custom `client_id` or `client_secret`, one will be generated automatically. The `client_id` must be unique among all clients in your project.

**Important:** This is the only time you will be able to view the generated `client_secret` in the API response. Stytch stores a hash of the `client_secret` and cannot recover the value if lost. Be sure to persist the `client_secret` in a secure location. If the `client_secret` is lost, you will need to trigger a secret rotation flow to receive another one.

## Request body

- ApiM2mV1M2mClientsCreateRequest: Request type
  - `scopes` string[], required: An array of scopes assigned to the client.
  - `client_id` string: If provided, the ID of the client to create. If not provided, Stytch will generate this value for you. The `client_id` must be unique within your project.
  - `client_secret` string: If provided, the stored secret of the client to create. If not provided, Stytch will generate this value for you. If provided, the `client_secret` must be at least 8 characters long and pass entropy requirements.
  - `client_name` string: A human-readable name for the client.
  - `client_description` string: A human-readable description for the client.
  - `trusted_metadata` object: The `trusted_metadata` field contains an arbitrary JSON object of application-specific data. See the [Metadata](https://stytch.com/docs/api/metadata) reference for complete field behavior details.

## Response `200`

Successful response

- ApiM2mV1M2mClientsCreateResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `m2m_client` ApiM2mV1M2MClientWithClientSecret, required
    - `client_id` string, required: The ID of the client.
    - `client_secret` string, required: The secret of the client. **Important:** this is the only time you will be able to view the `client_secret`. Be sure to persist the `client_secret` in a secure location. If the `client_secret` is lost, you will need to trigger a secret rotation flow to receive another one.
    - `client_name` string, required: A human-readable name for the client.
    - `client_description` string, required: A human-readable description for the client.
    - `status` string, required: The status of the client - either `active` or `inactive`.
    - `scopes` string[], required: An array of scopes assigned to the client.
    - `client_secret_last_four` string, required: The last four characters of the client secret.
    - `trusted_metadata` object: An arbitrary JSON object for storing application-specific data.
    - `next_client_secret_last_four` string: The last four characters of the `next_client_secret`. Null if no `next_client_secret` exists.
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2026-01-09** `7dfcc14e566c`: 2 breaking
  - the `trusted_metadata` request property type changed from `string` to `object`
  - the `m2m_client/trusted_metadata` response's property type changed from `string` to `object` for status `200`
- **2025-09-17** `8270cf3a3d4c`: 3 info
  - added the media type `application/json` for the response with the status `401`
  - added the media type `application/json` for the response with the status `500`
  - added the non-success response with the status `429`
- **2025-09-17** `864b9f438ac0`: 1 breaking
  - the `status_code` response's property type changed from `string` to `integer`, and format from no format to `int32` for status `200`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/m2m/clients/post.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)