# Agent clients An agent client is the OAuth client of an agent. It belongs to one organization. Its API tokens reach only that organization. ## Create a client 1. Sign in as an owner or admin of the organization. 2. Open `/orgs//developers/apps`. `/developers/apps` lists the organizations that you manage. 3. Enter the agent name, the kind, the redirect URIs and the scopes. 4. Copy the client ID. For a confidential client, copy the secret too. MapleID shows the secret one time only. MapleID asks for a recent sign-in before you create a client, change it, or make a new secret. ## The three kinds | Kind | Who uses it | Authentication | Redirect URI | |---|---|---|---| | Public native app | A program on the person's computer | PKCE | `http://127.0.0.1/` or `http://[::1]/`, on any port | | Public local web app | A local web server | PKCE | An exact `http://localhost:/` | | Confidential web app | A server that keeps a secret | `client_secret_basic` and PKCE | An exact `https://` URI | ## Rules - An organization has at most 10 active clients, and creates at most 20 in one day. - The name on the consent page is " - ". MapleID refuses a name that looks like MapleID, Maple Open Tech or a Maple app. - The consent page marks each agent client as an unverified agent and shows the redirect host. - A client can hold only the scopes on [Scopes](/developers/scopes). It never gets CORS origins, a webhook or a service scope. - If you remove a scope, the refresh tokens of the client stop working. The agent must sign in again. ## Disable a client An owner or admin disables a client on the same page. MapleID then refuses the client at the authorize and token endpoints, its refresh tokens stop working, and the agent API answers 401 `agent-client-inactive`. An access token that the client already has still works on userinfo until it expires, 15 minutes at most. Archiving the organization disables all its clients. A person can also end the access of one agent for themselves: "Apps with access" on `/account`.