Clients

Clients are the OAuth clients that external applications use to sign members in to Soln. Each client stores its application type, redirect addresses, and allowed scopes.

Open Account Center, then select Clients.

Before You Start

• The application developer needs three things from you: the client ID, the client secret, and the redirect addresses they must register
• Ask the developer which type the application is (web, desktop, Android, iOS) before you create the client, because the type cannot be changed later

Endpoints The Application Uses

Purpose	Endpoint
Discovery document	<platform address>/.well-known/openid-configuration
Authorization (browser redirect)	<platform address>/oauth/authorize
Token exchange	<platform address>/oauth/token
Member profile	<platform address>/oauth/userinfo

<platform address> is the address members use to sign in to Soln. The discovery document lists the exact endpoints, so the application can read them instead of hard-coding paths.

Defaults

Field	Default
Application type	Web application
Allowed scopes	openid, profile, and email, all selected
Redirect addresses	Empty; at least one address per line is required

Register An Application

1. Prepare the application side first: it needs the client ID and client secret that Soln issues, and the redirect addresses it will call back
2. In Soln click + next to the Clients menu entry
3. Enter the client name and choose the application type. The type decides which redirect and platform fields are required, and it cannot be changed after the client is created
4. Fill the platform fields of that type: for Android the package name and the SHA-256 certificate fingerprints, for iOS the bundle ID and the 10-character Apple team ID
5. Select the allowed scopes. openid, profile, and email are selected by default and cover sign-in, basic profile, and email address
6. Paste the redirect addresses of the application, one per line, following the rules of the application type
7. Save the client, copy the client secret from the dialog immediately, and store it on the application server together with the client ID
8. Run an authorization from the application and check the result under User Authorizations to confirm that the member granted the expected scopes

Verify An Integration

1. Configure the application server with the client ID, the client secret, and the registered redirect address
2. Start an authorization from the application and sign in as a member
3. Accept the requested scopes on the Soln authorization page
4. Check User Authorizations: the record appears with the status Authorized and the scopes the member granted

Rotate The Client Secret

1. In the client list, choose Rotate secret on a confidential client
2. Copy the new secret from the dialog, update the application server with it, and keep the old value only until the application has been deployed
3. Public clients have no secret, so the action is disabled for them

Troubleshooting

Symptom	What to check
redirect_uri is rejected	The address sent by the application must match a registered address exactly; for Android also check that the App Link domain serves /.well-known/assetlinks.json and that the package name and fingerprints match
The client is rejected as invalid	The client ID or client secret is wrong; after rotating the secret, update the application server
The requested scope is not granted	Every requested scope must be listed in the allowed scopes of the client
The application type is wrong	It cannot be changed; create a new client with the correct type
The application stopped working after a secret rotation	Copy the new secret from the dialog into the application server; the dialog shows it only once

Client List

Column	Description
Client name	Display name of the client
Application type	Web application, desktop application, Android, or iOS
Client ID	Identifier the application sends during authorization
Created at	Time the client was created

Search matches the client name, client ID, and application type. The client ID can be copied from the list.

Row actions are Edit, Rotate secret, and Delete. Rotate secret applies only to confidential clients; a public client has no secret to rotate. Deleting a client asks for confirmation and stops its existing authorizations immediately.

Create Or Edit A Client

Field	Description
Client name	Required, up to 200 characters
Application type	Required: web application, desktop application, Android, or iOS. It decides which redirect fields are required and cannot be changed after the client is created
Android package name	Required for Android, up to 255 characters, for example com.example.app
Android certificate fingerprints	Required for Android; one SHA-256 fingerprint per line
iOS Bundle ID	Required for iOS, up to 255 characters, for example com.example.app
Apple Team ID	Required for iOS; the 10-character team ID of the Apple Developer account, for example A1B2C3D4E5
Allowed scopes	Required. Available scopes are openid, profile, and email, and all three are selected by default
Redirect addresses	Required, one address per line

Redirect addresses depend on the application type:

Type	Required addresses
Web application	One or more exact public HTTPS redirect URIs
Desktop application	One or more local loopback addresses, for example http://127.0.0.1/oauth/callback. A dynamic port is allowed during authorization
Android	Package name, SHA-256 certificate fingerprints, and public HTTPS App Links. The domain must route /.well-known/assetlinks.json to Soln so Android can verify the package and signing certificate
iOS	Bundle ID, the 10-character Apple Team ID, and either a public HTTPS redirect address or an address that uses the bundle ID as its scheme

At least one redirect address is required.

Client Secret

Creating a client or rotating its secret opens a dialog that shows the secret in a read-only field with a copy button. The secret is shown once: copy it immediately, store it on the application server, and update the application configuration after a rotation, because the dialog does not show it again.