Skip to main content
Use Settings → Integrations to manage applications that connect an external platform to your organization. An OAuth App belongs permanently to the organization in which it was created. A private App can be installed only there. A public App keeps the same owner and Client ID, but eligible users from other organizations may install it; every installation and resource remains inside the customer organization selected during consent. The page has two views:
  • My OAuth Apps — applications owned by the current organization.
  • Connected apps — active and historical connections authorized for the current organization.
OAuth Apps are confidential-backend integrations. Never put a client secret, provider key, OAuth access or refresh token, or runtime gateway token in browser storage, screenshots, URLs, analytics, or logs.

​
Create an OAuth App

Open Settings → Integrations → My OAuth Apps, then choose Create OAuth app. The logo is optional. Choose a single-frame PNG, JPEG, or WebP image, then crop and rotate it in the separate crop dialog. The upload endpoint accepts one source image up to 10 MiB and 16 megapixels as decoder-safety boundaries. auto-orients, crops, removes metadata, decodes only image pixels, preserves transparency, and stores one normalized 256 × 256 WebP result in the database. Replacing the logo overwrites the stored image; it does not create image versions. The public asset URL includes the current content hash, so replacement refreshes My OAuth Apps, Connected apps, connection details, and new consent screens instead of reusing a cached image. App registration and logo upload are separate operations. If logo processing fails after Save, the OAuth App and its one-time client secret still exist; open Edit and retry the logo instead of creating another App.

​
Application details

Enter:
  • Application name — the required name users see on the consent screen and Connected apps; maximum 120 characters.
  • Description — an optional explanation of up to 1,000 characters.
  • Application website — an optional exact HTTPS page of up to 2,048 characters.
  • Allow other organizations to install this app — leave off for a private integration; enable for a self-service partner App that eligible customer organizations may authorize.
  • Redirect URIs — at least one unique exact HTTPS callback URI per line; maximum 2,048 characters each.
The redirect URI comes from the partner backend. For example, a partner might register https://partner.example.com/oauth/callback. A local demo needs an HTTPS tunnel such as https://example.trycloudflare.com/callback. Wildcards, URL credentials, fragments, and runtime-selected return URLs are rejected.

​
Permissions

The form groups permissions by what the partner can do: New Apps start with all seven permissions enabled. You may turn off any optional permission before saving.
  • Create protections · Required — resolve providers, run preflight, validate a provider key, discover models, and create protected resources. This is the minimum useful permission and cannot be disabled.
  • View protections — list and read only resources created by this connection.
  • Edit protection settings — change gateway names, model bindings, limits, logging, guardrails, and entitled OpenTelemetry settings for this connection.
  • Manage lifecycle and credentials — rotate provider/runtime credentials, revoke a protection, or reactivate one after review.
  • View protection request logs — read request metadata for this installation’s protection runtime tokens. OAuth never returns request or response bodies.
  • View protection spend — read token usage and monetary spend for this installation’s protections.
  • Renew access automatically — issue rotating refresh tokens so the backend can renew access without asking the user to reconnect every 15 minutes.
When all seven permissions, including Renew access automatically, are active, the form shows Complete protection lifecycle enabled. Turning off any optional permission changes the summary to Limited permission set. The partner must request exactly a subset enabled on the App; an authorization request containing one unavailable scope fails before consent. Choose Save. returns:
  • the public Client ID; and
  • one client secret shown once.
Copy the secret directly into the partner backend’s secret manager. It cannot be displayed again.

​
Use Details and Connections

Open an App’s More menu: Changing an App from public to private is allowed only when it has no active connection in another organization. Open Connections, disconnect every active external organization, then save the App as private. Otherwise keeps the App public and reports that its external installations must be disconnected first. A connection owned by the App’s creator organization does not block this change. is an OAuth authorization server, not an OpenID Connect identity provider. Details therefore shows authorization, token, and revocation endpoints but no UserInfo or ID Token endpoint.

​
Rotate a client secret safely

Open More → Secrets, then choose Rotate secret. supports up to two active secret slots so a partner can rotate without downtime:
  1. Create the replacement secret.
  2. Store the one-time value in the partner backend.
  3. Deploy and verify the partner with the replacement.
  4. Return to , select the old secret, and confirm Revoke.
While the App is active, its last usable secret cannot be revoked. Create and deploy a replacement first. A disabled App may retire its remaining secret because it cannot authorize or exchange tokens. Secret creation and revocation are retained in the audit trail.

​
Disable or delete an App

Disable is reversible. It revokes OAuth access/refresh tokens, runtime gateway tokens, and disables the installation’s internal Service Account for every active connection. Existing projects, provider credentials, gateways, settings, logs, protections, and audit history remain. Enabling the App again allows a new authorization, but does not reconnect installations automatically. Enable requires at least one non-revoked, non-expired client secret; rotate a replacement first if the disabled App has none. Delete retires the OAuth App itself. It revokes every client secret and connection and records the deletion in audit history. Protected resources remain for compliance and manual review; deleting the App is not a resource-erasure workflow.

​
Review Connected apps

Open Settings → Integrations → Connected apps. Active connections appear first. Disconnected connections remain under Disconnected history instead of disappearing. Choose Details on a connection:
  • Overview shows the current allowed permissions, owning organization, project, internal Service Account, protected-resource count, and last use.
  • History shows every Connect and Disconnect event with the permission snapshot effective at that moment. Later permission changes never rewrite older consent evidence.
Choose Disconnect to revoke that one connection. Disconnecting preserves its project and child resources.

​
Reconnect without duplicating resources

Reconnect from the partner’s Connect with action. For a public App, the person approving chooses from organizations where they are an active member, hold oauth-installations:connect, and have active product access. When several qualify, consent requires an explicit organization selection. Private Apps remain fixed to their creator organization. Active subscription, trial, and payment-retry (past_due) states qualify. Reauthorizing the same OAuth App to the same organization reuses the existing installation, project, internal Service Account, provider credentials, gateways, and stable protection IDs. It revokes every access/refresh token from the prior authorization; the partner must store only the newly exchanged token set. The partner then:
  1. Lists existing protections.
  2. Selects only connection_suspended protections that should resume.
  3. Calls reactivate for each selected protection and stores each newly returned runtime token.
  4. Leaves explicitly revoked protections disabled unless a user deliberately requests reactivation.
  5. May create additional protections in the same connection without duplicating existing ones.
If the preserved internal Service Account was permanently revoked rather than merely disabled, reauthorization fails with oauth_service_account_unrecoverable. An authorized user must review the installation instead of creating replacement resources automatically.

​
Developer handoff

Give the partner developer:
  • Client ID and one-time Client secret;
  • exact HTTPS redirect URI;
  • enabled permission list;
  • whether the App is private or public; and
  • OAuth partner integration guide.
For the standards-level authorize/token/revoke contract, use OAuth protocol. For every protection payload and lifecycle operation, use OAuth protection API.