--- title: "Create organization API client" method: POST path: "/api/v1/organizations/{organization_id}/clients" tags: ["API Auth"] --- # Create organization API client `POST /api/v1/organizations/{organization_id}/clients` Creates a new API client for an organization. Returns the client details and a plain secret (available only once). ## Path parameters - `organization_id` string, required ## Request body - ClientsOrganizationClient - `audience` string[] — The intended recipients of the access tokens issued to this client. Each audience value should be a URI that identifies the API or service that will validate the token. - `custom_claims` ClientsCustomClaim[] — Additional claims to be included in access tokens issued to this client. These claims provide context about the client and can be used for authorization decisions. Keep claims minimal to avoid increasing token size. - `key` string — The name of the custom claim. Must be between 1 and 128 characters. Use descriptive names that clearly indicate the claim's purpose. - `value` string — The value of the custom claim. This value will be included in access tokens issued to the client. - `description` string — A detailed explanation of the client's purpose and usage. This helps administrators understand what the client is used for and who manages it. - `expiry` string, int64 — Expiry time in seconds for the token generated by the client - `name` string — A descriptive name for the API client that helps identify its purpose. This name is displayed in the dashboard and logs. Must be between 1 and 128 characters. - `scopes` string[] — OAuth 2.0 scopes that define the permissions granted to this client. Each scope represents a specific permission or set of permissions. The client can only access resources that match its granted scopes. ## Response `201` API client created successfully. Returns the client ID and plain secret (only available at creation time). The client can be configured with scopes, audience values, and custom claims for fine-grained access control. - ClientsCreateOrganizationClientResponse - `client` ClientsM2MClient - `audience` string[] — The intended recipients of access tokens issued to this client. Each audience value should be a URI that identifies an API or service. - `client_id` string — The unique identifier for this API client. This ID is used to identify the client in API requests and logs. It is automatically generated when the client is created and cannot be modified. - `create_time` string, date-time — The timestamp when this API client was created. This field is automatically set by the server and cannot be modified. - `custom_claims` ClientsCustomClaim[] — Additional claims included in access tokens issued to this client. These claims provide context about the client and can be used for authorization decisions. - `key` string — The name of the custom claim. Must be between 1 and 128 characters. Use descriptive names that clearly indicate the claim's purpose. - `value` string — The value of the custom claim. This value will be included in access tokens issued to the client. - `description` string — A detailed description of the client's purpose and usage. This helps administrators understand what the client is used for. - `expiry` string, int64 — Expiry time in seconds for the token generated by the client - `is_cimd` boolean — Indicates if the client was created via Client ID Metadata Document (CIMD). CIMD clients can update their own configuration according to the CIMD specification. - `is_dcr` boolean — Indicates if the client was created via Dynamic Client Registration (DCR). Clients created through DCR may have different management and lifecycle policies compared to those created manually. - `metadata_uri` string — The URI to the client's metadata, which is utilized to obtain the client's configuration details - `name` string — The display name of the API client. This name helps identify the client in the dashboard and logs. - `organization_id` string — The ID of the organization that owns this API client. This ID is used to associate the client with the correct organization and enforce organization-specific access controls. - `redirect_uris` string[] — The redirect URI for this API client. This URI is used in the OAuth 2.0 authorization flow to redirect users after authentication. - `resource_id` string — The ID of the resource associated with this M2M client. This field is used to link the client to a specific resource in the system. - `scopes` string[] — The OAuth 2.0 scopes granted to this client. These scopes determine what resources and actions the client can access. - `secrets` ClientsClientSecret[] — List of client secrets associated with this client. Each secret can be used for authentication, but only the most recently created secret is typically active. Secrets are stored securely and their values are never returned after creation. - `create_time` string, date-time — The timestamp when this secret was created. This field is automatically set by the server and cannot be modified. - `created_by` string — The identifier of the user or system that created this secret. This field helps track who created the secret for audit and compliance purposes. - `expire_time` string, date-time — The timestamp when this secret will expire. After this time, the secret cannot be used for authentication regardless of its status. If not set, the secret does not expire. - `id` string — The unique identifier for this client secret. This ID is used to reference the secret in API requests for management operations like updating or deleting the secret. - `last_used_time` string, date-time — The timestamp when this secret was last used for authentication. This field helps track secret usage for security monitoring and identifying unused secrets that may be candidates for rotation. - `plain_secret` string — The full plaintext secret value. This field is only populated when the secret is first created and is never stored by the server. It must be securely stored by the client application as it cannot be retrieved again. - `secret_suffix` string — A suffix that helps identify this secret. This is the last few characters of the full secret value but is not sufficient for authentication. Helps identify which secret is being used in logs and debugging. - `status` 'INACTIVE' — ClientSecretStatus indicates whether a client secret can be used for authentication. ACTIVE secrets can be used for authentication while INACTIVE secrets cannot. - INACTIVE: The secret is inactive and cannot be used for authentication - `update_time` string, date-time — The timestamp when this secret was last updated. This field is automatically updated by the server when the secret's status changes or other properties are modified. - `update_time` string, date-time — The timestamp when this API client was last updated. This field is automatically updated by the server whenever the client's configuration changes. - `plain_secret` string — Client secret value (only returned once at creation) --- [API](https://skmtc.net/scalekit/apis/scalekit-api-reference.md) · [All operations](https://skmtc.net/scalekit/apis/scalekit-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/scalekit/scalekit-api-reference/versions/a40d5d4650e5/schema)