Registering an app
Every app or service that talks to CSI Auth is registered as a client. This guide covers choosing the right app type, requesting one, and handling secrets over its lifetime.
App types
A public client cannot keep a secret. If your app runs in a browser or on a device, use authorization code with PKCE and do not issue it a secret.
Requesting a client
Grant types
Request only the grants the app uses. A machine-to-machine client that never acts for a user does not need the authorization code grant.
Scopes
Scopes are granted per client against a specific API. Ask for the narrowest set that covers the app’s behavior.
Callback and logout URLs
Redirect URIs are matched exactly. Register each environment’s URL, and do not use wildcards.
Storing the secret
The secret is returned once: at creation and at rotation. Store it immediately in the approved secret store; it cannot be retrieved afterwards.
Rotating a secret
Rotation invalidates the previous secret immediately. Plan the change so every consumer is updated in the same window.
- Confirm every consumer of the client and who owns it
- Rotate
- Distribute the new secret through the secret store
- Redeploy or restart consumers
- Verify authentication before closing the change
Deleting a client
Deleting a client stops it from obtaining new tokens. Tokens already issued stay valid until they expire, so a compromise needs a shorter response than deletion alone.