Register and manage OIDC clients

Use the OIDC Clients screen to manage clients that external systems and SSO applications use to obtain D.Hub tokens. This screen supports both machine-to-machine (M2M) calls and delegated user sign-in.

Administrator-only page

Only users with the Administrator type can access this screen. A user without permission who opens the address directly is redirected to Home.

Open OIDC Clients

Select System → Settings → OIDC Clients in the sidebar.

Client list

Registered clients appear in a table with Client ID, Name, Grant Type, Audiences, and Created columns.

• Search: Narrow the list by entering a Client ID, name, or audience.
• Filter: Select All / Authorization code / Client credentials to show clients by grant type.
• Open details: Select a row to open the edit screen.

Client and grant types

Field	Options	Purpose
Client type	Confidential / Public	A Confidential client is a server-side client that can store a secret safely. A Public client is a browser or mobile client that cannot store a secret.
Grant type	Authorization code / Client credentials	Authorization code delegates user sign-in for an SSO application. Client credentials supports server-to-server calls without a user.

Selecting Public requires PKCE and prevents use of refresh tokens and the client-credentials grant.

Register a client

1. Select Register at the top right of the list. The Register OIDC client screen opens.

2. Enter the fields in each section.

   Field	Required	Description
   Client ID	Required	Unique identifier used to issue tokens. Use only letters, numbers, colons, underscores, and hyphens.
   Name	Required	A recognizable name for lists and audit records.
   Description	Optional	Records the client owner and purpose.
   Client type	Required	Select Confidential (default) or Public.
   Grant type	Required	Select Authorization code, Client credentials, or both.
   Require PKCE	—	Requires PKCE verification for authorization-code exchange.
   Allow refresh token	—	Allows refresh-token issuance.
   Redirect URI	Required with authorization code	Enter an HTTP or HTTPS address that receives the authorization code, then press Enter.
   Allowed audience	Optional	Restricts services that the client can call. The default is dhub2-manager.

3. Select Create.

Client ID, client type, and grant type cannot be changed after creation

On the edit screen, change only the name, description, redirect URIs, and allowed audiences. Register another client to change its identifier or authentication method.

Manage the client secret

After creating a Confidential client, its secret appears in the Client secret created dialog. Select Copy, store it securely, then select the confirmation checkbox before closing the dialog.

The secret is shown only once

The secret value appears only immediately after creation or rotation and cannot be retrieved later. If it is lost, use Rotate secret to issue another.

To replace the secret, select Rotate secret from the row action menu or edit screen. Rotation can invalidate the previous secret immediately. Update the external service with the new secret before resuming its use.

Delete a client

Select Delete from the row action menu. The Delete button is enabled only after you enter the exact Client ID in the confirmation dialog.

Deletion stops external-service authentication

After deletion, external services using this Client ID can no longer obtain tokens. Confirm that no integration still uses it.

Next steps

• Service accounts and access tokens — Manage automation accounts that authenticate with access tokens instead of OAuth integration.
• Authentication and access control — Review sign-in methods and role-based access.