A client is an application: a web front end, a mobile app, or a machine-to-machine integration. Registering a client tells Versola what that application is allowed to ask for. For the conceptual picture, see Entities.
- Client ID — lowercase letters, digits and hyphens, starting with a letter. Immutable.
- Confidential or public — a client created with a secret is confidential and authenticates at the token endpoint; one without a secret is public and relies on PKCE alone. Secrets can be rotated: the previous secret stays valid until you delete it.
- Redirect URIs — the exact allowed
redirect_urivalues. - Scopes — the scopes this client may request, which govern the claims it receives.
- Permissions — endpoints the client may call in its own name, used by the
client_credentialsgrant where there is no resource owner. - Access token TTL — how long its access tokens live.
- Auth flow — the sequence of challenges Versola presents when a user logs in through this client: which primary credential to ask for (phone, email, or login + password), which additional factors are required, and whether passkeys are offered. Two clients in the same tenant can enforce completely different login experiences over the same user base.
- Logout — optional front-channel and back-channel logout URIs.