Create a client

POST /organizations/{org}/clients

Creates a client. The id, logo and signing key are generated for you. A confidential client comes back with its client_secret, and this is the only time you will see it.

Authorization

Org owner. Anyone else gets 403 forbidden.

Path parameters

Name	Type	Description
`org`	string	The organization: its id (`org_…`) or its slug. It has to be an org your token can manage (see Who can call it)

Body

Field	Type	Required	Description
`name`	string	yes	1–120 characters, trimmed
`redirect_uris`	string[]	no	Each https, or http on `localhost`, `127.0.0.1` or `[::1]`. Default `[]`
`confidential`	boolean	no	Default `false`
`ip_allowlist`	string[]	no	IPs or CIDRs the client may call the token endpoint from. Blank entries are dropped

Response

201 Created

{
  "id": "cli_65f1c2a9e4b0d3f7a1c8e903",
  "name": "Acme backend",
  "logo": "https://…",
  "redirect_uris": ["https://app.acme.com/lgw/callback"],
  "confidential": true,
  "ip_allowlist": [],
  "client_secret": "…"
}

Field	Type	Description
`id`	string	`cli_…`
`name`	string
`logo`	URL
`redirect_uris`	URL[]
`confidential`	boolean
`ip_allowlist`	string[]	Present on confidential clients only
`client_secret`	string	Only on a response that just minted a secret. It is never shown again

Errors

Status	`error`	When
`400`	`invalid_request`	An unknown field, or a value that fails validation. The detail names it
`403`	`forbidden`	You are not an owner of the org
`404`	`not_found`	The org does not exist, or your token cannot manage it

Example

curl -X POST https://loginwith.loginwith.dev/organizations/acme/clients \
  -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" \
  -d '{"name": "Acme backend", "confidential": true, "redirect_uris": ["https://app.acme.com/lgw/callback"]}'