Sign in

v1

latestOpenAPI 3.0.12026-07-26171200932.8 KB
SSO - Applications

Register OAuth application

Rate limit: 60 requests per 60 seconds. This is the default shared quota — it is shared with every other endpoint that has no dedicated limit, so requests across those endpoints all draw from the same budget.

Creates a new OAuth application. The authenticated user automatically becomes the application admin. Both clientId and clientSecret are auto-generated server-side. The clientSecret is returned only in this response (one-time reveal) - subsequent reads will never expose it again, so callers must store it securely. Auto-populated defaults (audience, applicationType, supported flows, token expirations) come from service configuration. Validation is aligned with the upstream sts-metadata-api: applicationName max 100 chars, applicationIconUrl max 500 chars, each redirectUri max 500 chars and unique, each scopeId positive and recognized in the cached scope catalog.

post/api/v1/sso/applications

Headers

x-request-idstring uuid required
Example:e8f76398-133a-4a2f-839f-c11378cb5287

A unique request identifier.

x-api-keystring password required
Example:lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663

API key for authentication.

x-user-keystring password required
Example:eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_

User-specific authentication key.

Request body

applicationNamestring required

Display name shown to end users in the OAuth consent screen.

applicationIconUrlstring uri required

Publicly reachable URL of the application icon. Format-validated only - the URL is not fetched by the service.

redirectUrisstring[] required

OAuth redirect URIs registered for the application. Must be unique. Each URI is capped at 500 characters.

Example request

{
  "applicationName": "My Trading App",
  "applicationIconUrl": "https://cdn.etoro.com/icons/my-app.png",
  "redirectUris": [
    "https://myapp.com/oauth/callback"
  ]
}

Response

Application created successfully. The clientSecret is included once and only once.

clientSecretstring uuid

OAuth client secret. Returned exactly once at creation time and never again - store it securely.