> ## Documentation Index > Fetch the complete documentation index at: https://docs.airctrl.dev/llms.txt > Use this file to discover all available pages before exploring further. # Manage OAuth integrations > Register partner applications, rotate client secrets, and review connected apps. Use **Settings → Integrations** to manage applications that connect an external platform to your AIRCTRL organization. An OAuth App belongs permanently to the organization in which it was created. A private App can be installed only there. A public App keeps the same owner and Client ID, but eligible users from other organizations may install it; every installation and resource remains inside the customer organization selected during consent. The page has two views: * **My OAuth Apps** — applications owned by the current organization. * **Connected apps** — active and historical connections authorized for the current organization. > [!WARNING] > > OAuth Apps are confidential-backend integrations. Never put a client secret, provider key, OAuth > access or refresh token, or runtime gateway token in browser storage, screenshots, URLs, analytics, > or logs. ## Create an OAuth App Open **Settings → Integrations → My OAuth Apps**, then choose **Create OAuth app**. ### Application logo The logo is optional. Choose a single-frame PNG, JPEG, or WebP image, then crop and rotate it in the separate crop dialog. The upload endpoint accepts one source image up to 10 MiB and 16 megapixels as decoder-safety boundaries. AIRCTRL auto-orients, crops, removes metadata, decodes only image pixels, preserves transparency, and stores one normalized 256 × 256 WebP result in the AIRCTRL database. Replacing the logo overwrites the stored image; it does not create image versions. The public asset URL includes the current content hash, so replacement refreshes **My OAuth Apps**, **Connected apps**, connection details, and new consent screens instead of reusing a cached image. App registration and logo upload are separate operations. If logo processing fails after **Save**, the OAuth App and its one-time client secret still exist; open **Edit** and retry the logo instead of creating another App. ### Application details Enter: * **Application name** — the required name users see on the consent screen and Connected apps; maximum 120 characters. * **Description** — an optional explanation of up to 1,000 characters. * **Application website** — an optional exact HTTPS page of up to 2,048 characters. * **Allow other AIRCTRL organizations to install this app** — leave off for a private integration; enable for a self-service partner App that eligible customer organizations may authorize. * **Redirect URIs** — at least one unique exact HTTPS callback URI per line; maximum 2,048 characters each. The redirect URI comes from the partner backend. For example, a partner might register `https://partner.example.com/oauth/callback`. A local demo needs an HTTPS tunnel such as `https://example.trycloudflare.com/callback`. Wildcards, URL credentials, fragments, and runtime-selected return URLs are rejected. ### Permissions The form groups permissions by what the partner can do: New Apps start with all seven permissions enabled. You may turn off any optional permission before saving. * **Create protections · Required** — resolve providers, run preflight, validate a provider key, discover models, and create protected resources. This is the minimum useful permission and cannot be disabled. * **View protections** — list and read only resources created by this connection. * **Edit protection settings** — change gateway names, model bindings, limits, logging, guardrails, and entitled OpenTelemetry settings for this connection. * **Manage lifecycle and credentials** — rotate provider/runtime credentials, revoke a protection, or reactivate one after review. * **View protection request logs** — read request metadata for this installation's protection runtime tokens. OAuth never returns request or response bodies. * **View protection spend** — read token usage and monetary spend for this installation's protections. * **Renew access automatically** — issue rotating refresh tokens so the backend can renew access without asking the user to reconnect every 15 minutes. When all seven permissions, including **Renew access automatically**, are active, the form shows **Complete protection lifecycle enabled**. Turning off any optional permission changes the summary to **Limited permission set**. The partner must request exactly a subset enabled on the App; an authorization request containing one unavailable scope fails before consent. Choose **Save**. AIRCTRL returns: * the public Client ID; and * one client secret shown once. Copy the secret directly into the partner backend's secret manager. It cannot be displayed again. ## Use Details and Connections Open an App's **More** menu: | Action | What it does | | - | - | | **Edit** | Changes display fields, redirect URIs, and allowed permissions. | | **Details** | Shows the Client ID, registered redirects, current permissions, discovery-derived OAuth endpoints, and developer guide. | | **Connections** | Lists organizations connected to this App and their protected-resource counts. | | **Secrets** | Rotates or revokes confidential client secrets. | | **Disable / Enable** | Disconnects every active installation and blocks new authorization, or makes the retained App definition available for authorization again. | | **Delete** | Permanently retires the Client ID, revokes its secrets and active installations, and removes it from My OAuth Apps. | Changing an App from public to private is allowed only when it has no active connection in another organization. Open **Connections**, disconnect every active external organization, then save the App as private. Otherwise AIRCTRL keeps the App public and reports that its external installations must be disconnected first. A connection owned by the App's creator organization does not block this change. AIRCTRL is an OAuth authorization server, not an OpenID Connect identity provider. Details therefore shows authorization, token, and revocation endpoints but no UserInfo or ID Token endpoint. ## Rotate a client secret safely Open **More → Secrets**, then choose **Rotate secret**. AIRCTRL supports up to two active secret slots so a partner can rotate without downtime: 1. Create the replacement secret. 2. Store the one-time value in the partner backend. 3. Deploy and verify the partner with the replacement. 4. Return to AIRCTRL, select the old secret, and confirm **Revoke**. While the App is active, its last usable secret cannot be revoked. Create and deploy a replacement first. A disabled App may retire its remaining secret because it cannot authorize or exchange tokens. Secret creation and revocation are retained in the audit trail. ## Disable or delete an App **Disable** is reversible. It revokes OAuth access/refresh tokens, runtime gateway tokens, and disables the installation's internal Service Account for every active connection. Existing projects, provider credentials, gateways, settings, logs, protections, and audit history remain. Enabling the App again allows a new authorization, but does not reconnect installations automatically. Enable requires at least one non-revoked, non-expired client secret; rotate a replacement first if the disabled App has none. **Delete** retires the OAuth App itself. It revokes every client secret and connection and records the deletion in audit history. Protected resources remain for compliance and manual review; deleting the App is not a resource-erasure workflow. ## Review Connected apps Open **Settings → Integrations → Connected apps**. Active connections appear first. Disconnected connections remain under **Disconnected history** instead of disappearing. Choose **Details** on a connection: * **Overview** shows the current allowed permissions, owning organization, project, internal Service Account, protected-resource count, and last use. * **History** shows every Connect and Disconnect event with the permission snapshot effective at that moment. Later permission changes never rewrite older consent evidence. Choose **Disconnect** to revoke that one connection. Disconnecting preserves its project and child resources. ## Reconnect without duplicating resources Reconnect from the partner's **Connect with AIRCTRL** action. For a public App, the person approving chooses from organizations where they are an active member, hold `oauth-installations:connect`, and have active product access. When several qualify, consent requires an explicit organization selection. Private Apps remain fixed to their creator organization. Active subscription, trial, and payment-retry (`past_due`) states qualify. Reauthorizing the same OAuth App to the same organization reuses the existing installation, project, internal Service Account, provider credentials, gateways, and stable protection IDs. It revokes every access/refresh token from the prior authorization; the partner must store only the newly exchanged token set. The partner then: 1. Lists existing protections. 2. Selects only `connection_suspended` protections that should resume. 3. Calls `reactivate` for each selected protection and stores each newly returned runtime token. 4. Leaves explicitly `revoked` protections disabled unless a user deliberately requests reactivation. 5. May create additional protections in the same connection without duplicating existing ones. If the preserved internal Service Account was permanently revoked rather than merely disabled, reauthorization fails with `oauth_service_account_unrecoverable`. An authorized AIRCTRL user must review the installation instead of creating replacement resources automatically. ## Developer handoff Give the partner developer: * Client ID and one-time Client secret; * exact HTTPS redirect URI; * enabled permission list; * whether the App is private or public; and * [OAuth partner integration guide](https://docs.airctrl.dev/guides/oauth-partner-integrations.md). For the standards-level authorize/token/revoke contract, use [OAuth protocol](https://docs.airctrl.dev/reference/oauth-protocol.md). For every protection payload and lifecycle operation, use [OAuth protection API](https://docs.airctrl.dev/reference/oauth-protections.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.