---
title: "Create an OAuth application"
method: POST
path: "/oauth_applications"
tags: ["OAuth Applications"]
---

# Create an OAuth application

`POST /oauth_applications`

Creates a new OAuth application with the given name and callback URL for an instance.
The callback URL must be a valid URL.
All URL schemes are allowed such as `http://`, `https://`, `myapp://`, etc...

## Request body

- object
  - `name` string, required — The name of the new OAuth application. Max length: 256
  - `redirect_uris` string[], nullable — An array of redirect URIs of the new OAuth application
  - `callback_url` string, nullable — The callback URL of the new OAuth application
  - `scopes` string, nullable — Define the allowed scopes for the new OAuth applications that dictate the user payload of the OAuth user info endpoint. Available scopes are `profile`, `email`, `public_metadata`, `private_metadata`. Provide the requested scopes as a string, separated by spaces.
  - `consent_screen_enabled` boolean, nullable — True to enable a consent screen to display in the authentication flow.
  - `pkce_required` boolean, nullable — True to require the Proof Key of Code Exchange (PKCE) flow.
  - `public` boolean, nullable — If true, this client is public and you can use the Proof Key of Code Exchange (PKCE) flow.

## Response `200`

An OAuth application with client secret

- OAuthApplicationWithSecret
  - `object` 'oauth_application', required
  - `id` string, required
  - `instance_id` string, required
  - `name` string, required
  - `client_id` string, required
  - `client_uri` string, nullable, required
  - `client_image_url` string, nullable, required
  - `dynamically_registered` boolean, required
  - `consent_screen_enabled` boolean, required
  - `pkce_required` boolean, required
  - `public` boolean, required
  - `scopes` string, required
  - `redirect_uris` string[], required
  - `callback_url` string, required — Deprecated: Use redirect_uris instead.
  - `authorize_url` string, required
  - `token_fetch_url` string, required
  - `user_info_url` string, required
  - `discovery_url` string, required
  - `token_introspection_url` string, required
  - `created_at` integer, required — Unix timestamp of creation.
  - `updated_at` integer, required — Unix timestamp of last update.
  - `client_secret` string — Empty if public client.

## Other responses

- `400` — Request was not successful
- `403` — Authorization invalid
- `422` — Invalid request parameters

---

[API](https://skmtc.net/clerk/apis/clerk-backend-api.md) · [All operations](https://skmtc.net/clerk/apis/clerk-backend-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/clerk/clerk-backend-api/versions/cf036e7951d3/schema)