Skip to main content

Application Registration

Before integrating, you must register your application with the Secrets Vault Identity service to obtain the necessary credentials.

Tenant provisioning​

Start by requesting and configuring your dedicated tenant. The tenant is an isolated environment for your users and authentication settings. During tenant creation, provide:

  • Tenant name: A unique, descriptive name to identify your environment.
  • User self‑registration: Whether users can self‑register for accounts within your tenant. If enabled, users can create accounts during the auth flow. (This can be changed later.)
  • Tenant type (cannot be changed):
    • 2FA tenant: Use Secrets Vault Identity as a second factor alongside an existing primary authenticator.
    • Regular tenant: Use Secrets Vault Identity as the primary authenticator for your application.
  • Additional PIN requirement: Whether an extra PIN is required as part of the authentication process. (This can be changed later.)
  • Admin credentials: Email and username for the initial admin user.

After provisioning, you can register applications within the tenant.

Application registration​

Register your application to integrate with Secrets Vault Identity.

1. Provide application details​

During registration, provide:

  • Application name and description: For identification.
  • Redirect URIs: Full, absolute URLs Secrets Vault Identity may redirect to after successful authentication. This is a critical security control against phishing and code interception.
  • Client type: Declare the app as a Confidential client or a Public client. This determines how you handle credentials and secure the flow.

2. Receive credentials​

Upon successful registration, Secrets Vault Identity issues:

  • client_id: A unique public identifier for your application (for both client types).
  • client_secret: A confidential secret used to authenticate at the token endpoint (only for confidential clients).

:::warning Secure credential storage The client_secret is highly sensitive. It must be stored securely on your server’s backend and never exposed in client‑side code (e.g., browser JavaScript or mobile binaries). :::