OAuth Clients

Overview

OAuth clients represent third-party applications that can access CTSO Central data on behalf of your users through the OAuth 2.0 protocol. As an administrator, you can register new clients, manage their credentials, and control their lifecycle from the OAuth Clients page.

Viewing Registered Clients

1. Navigate to Settings in the sidebar
2. Under Administration, select OAuth Clients

The page displays a table of all registered OAuth clients with the following columns:

• Name -- the application name and optional description
• Client ID -- a truncated version of the unique client identifier
• Platform -- the application type (Web, Mobile, Desktop, or Service)
• Status -- current state: active (green), suspended (amber), or revoked (red)
• Created -- when the client was registered

Use the search bar and filters at the top to narrow by name, status, or platform.

Creating a Client

1. Click Create Client in the top-right corner
2. Fill in the registration form:
   • Application Name (required) -- a human-readable name for the integration
   • Description -- brief explanation of what the client does
   • Client Type -- choose Confidential (server-side) for backends that can keep a secret, or Public (browser/mobile) for client-side apps
   • Platform -- select Web Application, Mobile App, Desktop App, or Service / Machine
   • Redirect URIs (required) -- one callback URL per line where users are sent after authorization
   • Allowed Scopes -- space- or comma-separated list of permission scopes (e.g., chapters:read members:read)
   • Grant Types -- check the OAuth flows this client can use: Authorization Code, Client Credentials, and/or Refresh Token
3. Click Create Client
4. A client secret is displayed. Copy it immediately and store it in a secure location.

Viewing Client Details

Click any row in the table (or the eye icon) to open the detail dialog. It shows:

• Client ID and current status
• Client type and platform
• Description
• Redirect URIs
• Grant types
• Allowed scopes
• Created date and last used date

Rotating a Client Secret

If a secret is compromised or needs periodic rotation:

1. Click the rotate icon on the client's row
2. Review the confirmation -- the old secret is invalidated immediately
3. Click Rotate Secret
4. Copy the new secret from the dialog and update your integration

Suspending and Activating Clients

• To suspend an active client, click the suspend icon (circle with a line) on its row and confirm. Active tokens will be rejected until the client is reactivated.
• To reactivate a suspended client, click the play icon and confirm. The client can then issue new tokens again.

Deleting a Client

1. The client must be suspended or revoked first -- the delete button is disabled for active clients
2. Click the trash icon on the client's row
3. Confirm the deletion

Pre-Configured Clients

CTSO Central comes with two pre-seeded OAuth clients:

• Zapier -- for the Zapier automation platform
• Power Automate -- for Microsoft Power Automate

These clients are ready to use once enabled. You can view and manage them like any other client on this page.

Scopes and Permissions

OAuth scopes map to the platform's RBAC resources and actions. When a user authorizes a client, the granted scopes are intersected with both the client's allowed scopes and the user's own RBAC permissions. This means a client can never access more than the authorizing user is permitted to see.