OAuth information
The information in the OAuth Information section of the manifest JSON represents these values on the Development view of the app build flow:
- Basic Information > Usage.
- Basic Information > OAuth information.
- Scope > Add Scopes.
Manifest JSON
{
"oauth_information": {
"usage": "",
"development_redirect_uri": "",
"production_redirect_uri": "",
"oauth_allow_list": ["", ""],
"strict_mode": false,
"subdomain_strict_mode": false,
"scopes": [
{
"scope": "user:read:email",
"optional": false
}
],
"scope_description": "scope description",
"enable_private_pkce_client": false,
"enable_public_pkce_client": false,
"development_public_key": null,
"production_public_key": null
}
}
Field Description
| Field | Description | Required |
|---|---|---|
usage | How the app is managed • account level: ADMIN_MANAGEMENT• user level: USER_OPERATION | Yes |
development_redirect_uri | Provide the development redirect URL to generate an authorization URL for development testing. | Yes |
production_redirect_uri | Provide the production redirect URL to generate an authorization URL for development testing. | No |
oauth_allow_list | OAuth Allow Lists | No |
strict_mode | This option only allows the redirections that exactly match the valid OAuth redirect URLs. Learn more | No |
subdomain_strict_mode | This option only allows the redirections that exactly match the subdomain of the valid OAuth redirect URLs. Learn more | No |
scopes | Scopes define the API methods this app is allowed to call. Scopes are restricted to specific resources like channels or files. Learn more | No |
scope_description | Describe how your app intends to use the selected scope(s) | No |
enable_private_pkce_client | PKCE for development app. Learn more | No |
enable_public_pkce_client | PKCE for production app. Learn more | No |
development_public_key | Public key configuration used for verifying JWT assertions in the development environment. Contains the JWKS inline or a well-known URL. | No |
development_public_key.enabled | Whether the public key feature is enabled for the development client. | No |
development_public_key.well_known_url | URL pointing to a JWKS endpoint (e.g. https://auth.example.com/.well-known/jwks.json). Mutually exclusive with keys. | No |
development_public_key.keys | Inline list of JSON Web Key (JWK) objects (RFC 7517). Mutually exclusive with well_known_url. | No |
development_public_key.keys[].kty | Key type. Identifies the cryptographic algorithm family, e.g. "RSA", "EC". (RFC 7517 §4.1) | Yes |
development_public_key.keys[].kid | Key ID used to match a specific key. (RFC 7517 §4.5) | No |
development_public_key.keys[].alg | Algorithm intended for use with the key, e.g. "RS256". (RFC 7517 §4.4) | No |
development_public_key.keys[].key_ops | Key operations, e.g. ["sign"], ["verify"]. (RFC 7517 §4.3) | No |
development_public_key.keys[].n | RSA modulus (base64url-encoded). Required for RSA keys. (RFC 7518 §6.3.1.1) | No |
development_public_key.keys[].e | RSA public exponent (base64url-encoded). Required for RSA keys. (RFC 7518 §6.3.1.2) | No |
development_public_key.keys[].crv | EC curve name, e.g. "P-256", "P-384". Required for EC keys. (RFC 7518 §6.2.1.1) | No |
development_public_key.keys[].x | EC x-coordinate (base64url-encoded). Required for EC keys. (RFC 7518 §6.2.1.2) | No |
development_public_key.keys[].y | EC y-coordinate (base64url-encoded). Required for EC keys. (RFC 7518 §6.2.1.3) | No |
development_public_key.keys[].x5u | X.509 URL. (RFC 7517 §4.6) | No |
development_public_key.keys[].x5c | X.509 certificate chain (base64-encoded DER). (RFC 7517 §4.7) | No |
development_public_key.keys[].x5t | X.509 SHA-1 thumbprint (base64url). (RFC 7517 §4.8) | No |
development_public_key.keys[].x5t#S256 | X.509 SHA-256 thumbprint (base64url). (RFC 7517 §4.9) | No |
production_public_key | Public key configuration used for verifying JWT assertions in the production environment. Contains the JWKS inline or a well-known URL. | No |
production_public_key... | Same subfields as development_public_key |