Clients

AM lets you create clients with specific redirect URIs, allowed origins, and token configurations—then rotate keys without downtime.

Mobile apps, web apps, backend services—each gets its own client with its own security settings.

Client Configuration

{
  id: "cid_...",
  account_id: "acc_...",
  name: "My Web App",
  allowed_origins: ["https://app.example.com"],
  redirect_uris: ["https://app.example.com/callback"],
  access_token_config: {
    expires_in: 3600  // 1 hour
  },
  refresh_token_config: {
    expires_in: 1209600  // 14 days
  }
}

Operations

Key Management

Clients sign tokens with RSA key pairs. AM stores private keys securely and exposes public keys via JWKS.

Keep 2-4 keys active during rotation so existing tokens remain valid.

Related

• OAuth - OAuth flows
• Client - Client resource
• Client Key - Signing keys