Agent clients
An agent client is the OAuth client of an agent. It belongs to one organization. Its API tokens reach only that organization.
Create a client
- Sign in as an owner or admin of the organization.
- Open
/orgs/<organization id>/developers/apps./developers/appslists the organizations that you manage. - Enter the agent name, the kind, the redirect URIs and the scopes.
- Copy the client ID. For a confidential client, copy the secret too. MapleID shows the secret one time only.
MapleID asks for a recent sign-in before you create a client, change it, or make a new secret.
The three kinds
| Kind | Who uses it | Authentication | Redirect URI |
|---|---|---|---|
| Public native app | A program on the person's computer | PKCE | http://127.0.0.1/<path> or http://[::1]/<path>, on any port |
| Public local web app | A local web server | PKCE | An exact http://localhost:<port>/<path> |
| Confidential web app | A server that keeps a secret | client_secret_basic and PKCE | An exact https:// URI |
Rules
- An organization has at most 10 active clients, and creates at most 20 in one day.
- The name on the consent page is "<organization> - <agent>". MapleID refuses a name that looks like MapleID, Maple Open Tech or a Maple app.
- The consent page marks each agent client as an unverified agent and shows the redirect host.
- A client can hold only the scopes on Scopes. It never gets CORS origins, a webhook or a service scope.
- If you remove a scope, the refresh tokens of the client stop working. The agent must sign in again.
Disable a client
An owner or admin disables a client on the same page. MapleID then refuses the client at the authorize and token endpoints, its refresh tokens stop working, and the agent API answers 401 agent-client-inactive. An access token that the client already has still works on userinfo until it expires, 15 minutes at most. Archiving the organization disables all its clients.
A person can also end the access of one agent for themselves: "Apps with access" on /account.