Developer apps

While the flag is off, the tab shows App registration is not turned on and says self-service registration is off, so there is nothing to register. Nothing else on the page works in that case.

When it is available, registering an app also needs a personal workspace on your account (your own, which is created when you first sign in to an application that needs one; an app you register stays with it if you later upgrade it to an organization). Without one the page says Registering an app needs a personal workspace, and this account has none. See Memberships for what a personal workspace is.

The page opens with a notice titled What an app of yours can be. In short, an app you register here is a public client:

• It holds no client secret, so there is no secret to rotate.
• Sign-in uses PKCE.
• DPoP is required, so tokens are bound to the app that asked for them.
• Only the openid, profile and email scopes are available.
• Redirect URIs must be exact https addresses, with no wildcard.

The notice also states how many apps you can register, suspended ones included, and how many redirect URIs one app can have (both are platform settings that can change). An app with a backend that must authenticate with a key is a different kind of client. It is not registered here.

You land on the new app's page. Registering needs a second factor you used in the last 30 minutes, like the other sensitive actions on your account. A dialog titled Confirm it is you opens if you need to confirm.

The form tells you if something is missing: Enter a name., Add at least one redirect URI. or Each redirect URI must be an exact https address with no wildcard.

The list is titled Your apps. Each row shows the App name, its Status, its Type, when it was Registered, the number of Redirect URIs and its Client ID. A footer counts how many of your allowed apps you have used. An empty list says No apps yet and that you can register one to get a client ID.

Select a row to open the app.

The page shows the app's Client ID in a field you can copy, its type, and whether DPoP is Required. Under Secrets it shows Client secret: None, because the app is a public client.

Details is a form to change the name, the redirect URIs and the scopes, with Save app. The type is not editable.

Status shows the app's state: Development, Active or Suspended. The button beside it is Suspend, or Enable for a suspended app. The suspend dialog is titled Suspend this app? and says people cannot sign in with it until you enable it again. A suspended app still counts against your limit.

If you open an app that does not exist or is not yours, the page says App not found.

• Build with identity
• Scopes
• Connected apps: what people see when your app asks to sign them in.