OAuth information

The information in the OAuth Information section of the manifest JSON represents these values on the Development view of the app build flow:

Manifest JSON

{
    "oauth_information": {
        "usage": "",
        "development_redirect_uri": "",
        "production_redirect_uri": "",
        "oauth_allow_list": ["", ""],
        "strict_mode": false,
        "subdomain_strict_mode": false,
        "scopes": [
            {
                "scope": "user:read:email",
                "optional": false
            }
        ],
        "scope_description": "scope description",
        "enable_private_pkce_client": false,
        "enable_public_pkce_client": false,
        "development_public_key": null,
        "production_public_key": null
    }
}

Field Description

FieldDescriptionRequired
usageHow the app is managed

• account level: ADMIN_MANAGEMENT

• user level: USER_OPERATION
Yes
development_redirect_uriProvide the development redirect URL to generate an authorization URL for development testing.Yes
production_redirect_uriProvide the production redirect URL to generate an authorization URL for development testing.No
oauth_allow_listOAuth Allow ListsNo
strict_modeThis option only allows the redirections that exactly match the valid OAuth redirect URLs. Learn moreNo
subdomain_strict_modeThis option only allows the redirections that exactly match the subdomain of the valid OAuth redirect URLs. Learn moreNo
scopesScopes define the API methods this app is allowed to call. Scopes are restricted to specific resources like channels or files. Learn moreNo
scope_descriptionDescribe how your app intends to use the selected scope(s)No
enable_private_pkce_clientPKCE for development app.

Learn more
No
enable_public_pkce_clientPKCE for production app.

Learn more
No
development_public_keyPublic key configuration used for verifying JWT assertions in the development environment. Contains the JWKS inline or a well-known URL.No
development_public_key.enabledWhether the public key feature is enabled for the development client.No
development_public_key.well_known_urlURL pointing to a JWKS endpoint (e.g. https://auth.example.com/.well-known/jwks.json). Mutually exclusive with keys.No
development_public_key.keysInline list of JSON Web Key (JWK) objects (RFC 7517). Mutually exclusive with well_known_url.No
development_public_key.keys[].ktyKey type. Identifies the cryptographic algorithm family, e.g. "RSA", "EC". (RFC 7517 §4.1)Yes
development_public_key.keys[].kidKey ID used to match a specific key. (RFC 7517 §4.5)No
development_public_key.keys[].algAlgorithm intended for use with the key, e.g. "RS256". (RFC 7517 §4.4)No
development_public_key.keys[].key_opsKey operations, e.g. ["sign"], ["verify"]. (RFC 7517 §4.3)No
development_public_key.keys[].nRSA modulus (base64url-encoded). Required for RSA keys. (RFC 7518 §6.3.1.1)No
development_public_key.keys[].eRSA public exponent (base64url-encoded). Required for RSA keys. (RFC 7518 §6.3.1.2)No
development_public_key.keys[].crvEC curve name, e.g. "P-256", "P-384". Required for EC keys. (RFC 7518 §6.2.1.1)No
development_public_key.keys[].xEC x-coordinate (base64url-encoded). Required for EC keys. (RFC 7518 §6.2.1.2)No
development_public_key.keys[].yEC y-coordinate (base64url-encoded). Required for EC keys. (RFC 7518 §6.2.1.3)No
development_public_key.keys[].x5uX.509 URL. (RFC 7517 §4.6)No
development_public_key.keys[].x5cX.509 certificate chain (base64-encoded DER). (RFC 7517 §4.7)No
development_public_key.keys[].x5tX.509 SHA-1 thumbprint (base64url). (RFC 7517 §4.8)No
development_public_key.keys[].x5t#S256X.509 SHA-256 thumbprint (base64url). (RFC 7517 §4.9)No
production_public_keyPublic key configuration used for verifying JWT assertions in the production environment. Contains the JWKS inline or a well-known URL.No
production_public_key...Same subfields as development_public_key