Skip to content
CEagle

Registering an application

An OAuth application belongs to a project. Registering one gets you a client id, and once, a client secret.

OAuth applications are registered in Aerie, against a project, and stored in CEagle accounts. That is why the console calls them credentials: they belong to a project the way a Flight source does.

In the console#

  1. Open a project's Credentials tab

    Any project. A project does not need a Flight source to have credentials.

  2. Choose a client type

    confidential for a server that can keep a secret; public for anything running on the user's machine.

  3. List every redirect URI

    They are compared exactly. No wildcards, no prefix matching, no ignored trailing slash.

  4. Pick permissions

    From the catalog. Add offline_access if you need a refresh token.

  5. Copy the secret

    It is shown once. Aerie keeps only a hash of it.

What it asks for#

Fields
name3 to 64 charactersRequired

What the consent screen calls your application. People decide whether to trust it partly on this.

descriptionat most 512 characters

Shown to the person consenting.

website_urihttp(s) URL

A homepage. Also shown on the consent screen.

client_typeconfidential | publicRequired

Cannot be changed later.

redirect_uris1 to 10 URIsRequired

Exact match. See below.

post_logout_redirect_urisup to 10

Where an end-session request may return.

permissions1 to 16 keysRequired

From the permission catalog.

Redirect URIs#

Compared exactly, character for character.

Registered

https://snake.example/callback

Rejected

https://snake.example/callback/, https://snake.example/Callback, http://snake.example/callback

Register every environment you need up front: production, staging, and whatever local address you develop against.

Changing one later#

Editing an application replaces its lists wholesale, so keep every redirect URI you still need in the field, not only the new one.

The client type cannot be changed. Register a second application if you need both.

Disabling and rotating#

Disable

A disabled application refuses every OAuth flow. Existing tokens are not revoked by this on their own.

Rotate the secret

Generates a new secret and invalidates the old one immediately. There is no overlap window.

Client secrets

Where to keep one, how to rotate without downtime, and what to do if one leaks.

Read on

Archiving the project#

Archiving a project disables every application registered against it, and records which ones it touched. Restoring re-enables exactly those and leaves alone any you had disabled yourself.

Archiving, not deleting

The three things archiving does, and how each is reversed.

Read on
CEagle documentation