---
title: "List my OAuth applications"
method: GET
path: "/api/v1/sso/applications"
tags: ["SSO - Applications"]
---

# List my OAuth applications

`GET /api/v1/sso/applications`

**Rate limit:** 60 requests per 60 seconds. This is the **default shared quota** — it is shared with every other endpoint that has no dedicated limit, so requests across those endpoints all draw from the same budget.

---

Returns every OAuth application where the authenticated user (matched by GCID) is listed as an administrator. Reads are served exclusively from an in-memory cache that is refreshed every few seconds from the upstream sts-metadata-api. The `clientSecret` is never included in this response - it can only be retrieved from the create response.

## Headers

- `x-request-id` string, uuid, required
- `x-api-key` string, password, required
- `x-user-key` string, password, required

## Response `200`

Successfully retrieved the list of administered applications. May be empty if the caller administers no applications.

- GetApplicationsResponse
  - `applications` ApplicationItem[] — Applications administered by the authenticated user. May be empty.
    - `applicationId` integer — Internal numeric identifier of the application.
    - `applicationName` string — Display name of the application.
    - `applicationIconUrl` string, uri — URL of the application icon.
    - `clientId` string, uuid — OAuth client identifier. Stable across the lifetime of the application.
    - `audience` string — OAuth audience claim issued for tokens minted for this application.
    - `applicationType` string — OAuth application type (e.g. `public`, `confidential`).
    - `scopes` ApplicationScopeItem[] — Scopes assigned to the application, including which are mandatory at consent time.
      - `scopeId` integer — Scope identifier.
      - `isMandatory` boolean — When true, the user cannot deselect this scope on the consent screen.
    - `redirectUris` string[] — Registered OAuth redirect URIs.
    - `supportedFlows` string[] — OAuth flows supported by the application (e.g. `authorization_code`, `refresh_token`).
    - `supportedCodeChallengeMethods` string[] — PKCE code-challenge methods supported by the application (e.g. `S256`).
    - `ssoIdTokenExpirationInMinutes` integer — Lifetime of issued SSO id tokens, in minutes.
    - `ssoRefreshTokenExpirationInMinutes` integer — Lifetime of issued SSO refresh tokens, in minutes.
    - `ssoAccessTokenExpirationInMinutes` integer — Lifetime of issued SSO access tokens, in minutes.
    - `adminGcids` integer[] — GCIDs of users who can administer this application.

## Other responses

- `401` — Missing or invalid STS access token.
- `429` — Too Many Requests — the shared rate limit (60 requests / 60s) was exceeded.

---

[API](https://skmtc.net/etoro/apis/etoro-api.md) · [All operations](https://skmtc.net/etoro/apis/etoro-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/etoro/etoro-api/revisions/69c1fb266c35/schema)