OAuth clients for integrations

An OAuth client is the credential an application presents to Librario. This page shows when you have to issue one, which values the connector needs, and how to rotate the client secret without dropping the connection.

Two levels

OAuth shows up on two levels in Librario. Keeping them apart makes every setting easy to find.

Per user: the connection. Every connection is authorised by an individual on the consent screen. It appears on that person’s Integrations page under “Connected applications”, where they can revoke it themselves at any time. That holds both for tools that register themselves (Claude, ChatGPT) and for clients an administrator issued. The permissions granted never exceed what the client allows.

Per account: the client. An administrator issues the client under Account → OAuth clients and manages it there: client ID, client secret, callback URLs, surface, allowed permissions and PKCE. Revoking the client ends every user’s connection at once.

How users check and revoke their connections is described under Manage and revoke connections. The rest of this page covers the account level.

When you need an OAuth client

Claude, ChatGPT and other MCP tools register with Librario on their own. You issue nothing for them; they appear on the respective user’s Integrations page after the first sign-in.

You need an OAuth client in two cases:

• Connectors with manual OAuth configuration. Copilot Studio (“Manual” type) and Gemini Enterprise ask for a client ID and client secret before they connect.
• Your own scripts against the REST API. A script that cannot use self-registration gets its client here, for the “REST API” surface.

The page is part of advanced MCP controls and needs a plan that includes them; self-registration does not. It requires the administrator role on top of REST API or MCP access, independently of who may see the rest of the account settings.

Create a client

1. Open Account → OAuth clients and click New OAuth client.
2. Name: appears on the consent screen and on the Integrations page of every user who authorises the client.
3. Callback URLs: exactly as the connector shows them. https only; plain http only on a loopback address (127.0.0.1, [::1]) or on localhost with an explicit port, in every case without a fragment and without credentials. Use Add callback URL to enter more.
4. Surface: “AI assistants (MCP)” for connectors, “REST API” for scripts.
5. Permissions: what the client may request at most. A user can grant less when authorising, never more.
6. Require PKCE: leave it on whenever the connector supports PKCE. Copilot Studio in manual configuration sends no code_challenge; switch PKCE off there. For Gemini Enterprise leave it on; if the connector reports at sign-in that the code_challenge parameter is required, it sends none, and you create the client again without PKCE. Switching it off is recorded.

If creation fails, the form comes back with the problems marked. The usual causes: a callback URL with plain http outside the loopback addresses, localhost without a port, a fragment or credentials in the URL, or no permission ticked at all.

Enter the values in the connector

After creation Librario shows every value a connector asks for. This page opens only once, not even with Back or Reload. Copy every value in one go.

Manage client secrets

The list shows each client’s Client ID, surface, allowed permissions and whether it requires PKCE: the green “PKCE” badge or the amber “No PKCE” badge, a green or amber shield icon on narrow screens. Below sit its valid client secrets, recognisable by their first characters, and for each when it was created, last used and expires. At most two are valid at a time. As long as everything is fine, the Client secrets section stays collapsed to a one-line summary. When a client secret has an expiry date, or when the client has no valid client secret left at all, the section opens by itself. In the second case the client’s row also carries the amber badge “No valid client secret”.

Rotate a client secret

1. Expand Client secrets and, if you like, give the new secret a label, such as the reason for the rotation.
2. Choose what happens to the current client secret: retire now (the default), or keep it for another 24 hours, 7 days or 30 days. That window is the time you have to enter the new client secret in the connector without it losing its connection.
3. Click New client secret. Librario shows the new one as it did at creation, exactly once.
4. Enter it in the connector. The last use of the two entries tells you whether the connector has switched to the new one yet.
5. Once it has, retire the previous one early with Retire. Otherwise it stops working on its own at the expiry date.

While two client secrets are valid, the list hides the form until you have retired one. Issuing and retiring are both recorded.

A compromised client secret

If a client secret has ended up in a repository, a chat transcript or an email, act at once:

• Issue a New client secret with retire now if the connector should carry on right away. Then enter the new client secret in the connector.
• Or Retire the affected entry. That works on a client’s only client secret too; the client then has no valid client secret, and the connector gets no token until you issue one with New client secret.

Either way a connector presenting the old client secret gets no token from now on. The client and every user’s connection stay; they carry on as soon as the connector uses a new client secret.

Revoke a client

Revoke ends every connection of a client immediately, for every user who authorised it. The consents are kept for audit purposes. The client disappears from the list; note the client ID beforehand if you might need it for an audit later.

Revoke a client when the connector is being shut down or is no longer trusted. If only a client secret is at stake, rotate the client secret; the connections stay.

Further reading

• Endpoints, PKCE, scopes and self-registration (Dynamic Client Registration): REST API.
• The steps inside Copilot Studio and Gemini Enterprise: Connect AI assistants (MCP).
• How users revoke their connections: Manage and revoke connections.