OAuth & API tokens

Phase 1 preview — pages render fixture data only; no changes are saved.

Preview only. Nothing is created, rotated, revoked or enforced from this screen, and no credential is generated. Secrets and token values are never shown.

OAuth clients

Applications allowed to request access on a person's behalf. Client secrets are stored in plain text by legacy and shown to administrators; here they are never shown, only whether one exists.

Name	Client ID	Type	Redirect URI	Status	Secret	Tokens	Owner	Created	Actions
Asset desk mobile app	1	Authorization code	https://mobile.example.test/oauth/callback	Active	Secret exists	12	Admin User	2025-03-10	Edit Revoke Delete
Personal Access Client	2	Personal access	http://localhost	Active	Secret exists	4	—	2022-01-05	Edit Revoke Delete
Legacy password grant	3	Password grant	http://localhost	Revoked	Secret exists	0	Admin User	2022-01-05	Edit Unrevoke Delete
<b>Kiosk</b> "<script>alert(1)</script>"	4	Authorization code	https://kiosk.example.test/cb?x=<script>	Active	Secret exists	1	Alex Kim	2026-05-02	Edit Revoke Delete
Reporting exporter	5	Authorization code	https://reports.internal.example.test/oauth/callback/with/a/very/long/path/that/keeps/going/and/going/until/it/no/longer/fits/on/one/line	Active	Secret exists	3	Alex Kim	2026-01-20	Edit Revoke Delete

Creating a client needs a name and an https redirect URI and produces an authorization-code, confidential client. There is no secret rotation or reveal-once. Only a client's owner can edit it, even for a superuser.