Herald
OpenapiClient

Create a new client app

Creates a new OAuth client application with the specified configuration.

POST
/api/client/{realmId}

Creates a new OAuth client application with the specified configuration.

Path Parameters

realmId*string

Realm ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

allowedOrigins?array<string>|null
browserRefreshAbsoluteTtlSeconds?|
Formatint32
clientId*string

OAuth client identifier (3-36 characters)

Used as the client_id in OAuth flows. Must be unique within the realm. Can contain alphanumeric characters only.

description?|

Detailed description of the client application (max 500 characters)

Optional description explaining the purpose and functionality of the application.

deviceCodeGrantEnabled?boolean|null
emailVerifyReturnUrl?string|null
enabled?|

Whether this client application is active

When set to false, the client cannot be used for new OAuth flows.

iconUrl?|

URL to client application icon (favicon, logo)

Optional URL to an image file that will be displayed as the app icon. Should be a valid HTTPS URL to an image resource.

name*string

Human-readable application name (1-100 characters)

Display name shown to users in authorization screens and admin panels.

passwordResetReturnUrl?string|null
redirectUris?array<string>|

Allowed OAuth redirect URIs

List of valid redirect URIs for OAuth flows. Must be valid HTTPS URLs (http://localhost is allowed for development). Users will only be redirected to these URIs after authentication.

turnstileEnabled?|

Enable Cloudflare Turnstile human-verification for this Client App (D-PROTECT-01). Defaults to false.

turnstileSecretKey?|

Cloudflare Turnstile secret key (server-side, sensitive). Write-only: never echoed back in responses.

turnstileSiteKey?|

Cloudflare Turnstile site key (public). Optional; only used when Turnstile is enabled.

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/api/client/string" \  -H "Content-Type: application/json" \  -d '{    "clientId": "mywebapp",    "name": "My Web Application"  }'
{  "allowedOrigins": [    "string"  ],  "browserRefreshAbsoluteTtlSeconds": 0,  "clientId": "my-web-app",  "clientSecret": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",  "description": "Internal admin dashboard for organization management",  "deviceCodeGrantEnabled": true,  "emailVerifyReturnUrl": "string",  "enabled": "true",  "iconUrl": "https://example.com/logo.png",  "id": "01234567-89ab-cdef-0123-456789abcdef",  "isFirstParty": true,  "name": "My Web Application",  "passwordResetReturnUrl": "string",  "realmId": "my-realm",  "redirectUris": [    "https://example.com/callback",    "http://localhost:3000/auth/callback"  ],  "turnstileEnabled": true,  "turnstileSiteKey": "string"}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}