OAuth clients for integrations

An OAuth client is the credential an application presents to Librario. This page shows when you have to issue one, which values the connector needs, and how to rotate the client secret without dropping the connection.

Two levels

OAuth shows up on two levels in Librario. Keeping them apart makes every setting easy to find.

Per user: the connection. Every connection is authorised by an individual on the consent screen. It appears on that person’s Integrations page under Connected applications, where they can revoke it themselves at any time. That holds both for tools that register themselves (Claude, ChatGPT) and for clients an administrator issued. The permissions granted never exceed what the client allows.

An access token is valid for one hour. The connector then renews it silently with a refresh token that stays valid until the person or an administrator revokes the connection. File links an assistant receives expire after 15 minutes.

Per account: the client. An administrator issues the client under Our account → Settings → Manage OAuth clients and manages it there: client ID, client secret, callback URLs, surface, allowed permissions and PKCE. Revoking the client ends every user’s connection at once.

The account administration shows no list of the people who authorised a client. Each person sees only their own connections on their Integrations page.

How users check and revoke their connections is described under Manage and revoke connections. The rest of this page covers the account level.

When you need an OAuth client

Claude, ChatGPT and other MCP tools register with Librario on their own. You issue nothing for them; they appear on the respective user’s Integrations page after the first sign-in.

You need an OAuth client in two cases:

• Connectors with manual OAuth configuration. The Microsoft 365 Copilot federated connector, Copilot Studio (Manual type) and Gemini Enterprise ask for a client ID and client secret before they connect.
• Your own scripts against the REST API. A script that cannot use self-registration gets its client here, for the REST API surface. The client replaces self-registration, not the sign-in: a script, too, gets its first token only after a person has signed in once in a browser and consented. From then on it runs on the refresh token, with that person’s roles. The client belongs to the account, the connection to the person: deleting that person’s user ends their connections, and once someone else signs in, the script carries on with the same client.

Issuing clients and client secrets is part of advanced AI controls and needs a plan that includes them; self-registration does not. The page requires the administrator role on top of REST API or MCP access, independently of who may see the rest of the account settings.

If your plan no longer includes advanced AI controls, the clients issued here stop working: nobody can authorise them, and Librario refuses every request made with their tokens. Nothing is deleted. The page stays available while clients are left: you can still see and revoke them, but not issue new clients or client secrets. Once the option is back on the plan, the clients and their connections work again. Some connectors ask the person to sign in once more after their requests were refused.

Create a client

1. Open Our account → Settings → Manage OAuth clients and click New OAuth client.
2. Name: appears on the consent screen and on the Integrations page of every user who authorises the client.
3. Callback URLs: exactly as the connector shows them. https only; plain http only on a loopback address (127.0.0.1, [::1]) or on localhost with an explicit port, in every case without a fragment and without credentials. Use Add callback URL to enter more.
4. Surface: AI assistants (MCP) for connectors, REST API for scripts.
5. Permissions for AI assistants (MCP) or Permissions for REST API: what the client may request at most. A user can grant less when authorising, never more.
6. Require PKCE: leave it on whenever the connector supports PKCE. For the Microsoft 365 Copilot federated connector and Gemini Enterprise leave it on and switch PKCE on in the connector as well. Copilot Studio’s manual configuration has no PKCE setting; switch PKCE off there. If a connector reports at sign-in that the code_challenge parameter is required, it sends none, and you create the client again without PKCE. Librario accepts only the S256 method; a connector that reports invalid_request sends a different one.

If creation fails, the form comes back with the problems marked. The usual causes: a callback URL with plain http outside the loopback addresses, localhost without a port, a fragment or credentials in the URL, or no permission ticked at all.

Enter the values in the connector

After creation Librario shows every value a connector asks for. This page opens only once, not even with Back or Reload in the browser. Copy every value in one go.

Manage client secrets

The list shows each client’s Client ID, surface, allowed permissions and whether it requires PKCE: the green PKCE badge or the amber No PKCE badge, a green or amber shield icon on narrow screens. Below sit its valid client secrets, recognisable by their first characters, and for each when it was created, last used and expires. At most two are valid at a time. As long as everything is fine, the Client secrets section stays collapsed to a one-line summary. When a client secret has an expiry date, or when the client has no valid client secret left at all, the section opens by itself. In the second case the client’s row also carries the amber badge No valid client secret.

Rotate a client secret

1. Expand Client secrets and, if you like, give the new secret a label, such as the reason for the rotation.
2. Choose what happens to the current client secret: Retire the current one now (the default), or keep it for another 24 hours, 7 days or 30 days. That window is the time you have to enter the new client secret in the connector without it losing its connection.
3. Click New client secret. Librario shows the new one as it did at creation, exactly once.
4. Enter it in the connector. The last use of the two entries tells you whether the connector has switched to the new one yet. The connector reaches the token endpoint only when it renews a token, at most hourly per active person, so the last use can lag accordingly.
5. Once it has, retire the previous one early with Retire. Otherwise it stops working on its own at the expiry date.

While two client secrets are valid, the list hides the form until you have retired one.

A compromised client secret

If a client secret has ended up in a repository, a chat transcript or an email, act at once:

• Issue a New client secret with Retire the current one now if the connector should carry on right away. Then enter the new client secret in the connector.
• Or Retire the affected entry. That works on a client’s only client secret too; the client then has no valid client secret, and the connector gets no token until you issue one with New client secret.

Either way a connector presenting the old client secret gets no token from now on. The client and every user’s connection stay; they carry on as soon as the connector uses a new client secret.

Revoke a client

Clicking Revoke ends every connection of a client immediately, for every user who authorised it. The client disappears from the list; note the client ID beforehand if you might need it later.

Revoke a client when the connector is being shut down or is no longer trusted. If only a client secret is at stake, rotate the client secret; the connections stay.

Further reading

• Endpoints, PKCE, scopes and self-registration (Dynamic Client Registration): REST API.
• The steps inside Microsoft 365 Copilot, Copilot Studio and Gemini Enterprise: Connect AI assistants (MCP).
• How users revoke their connections: Manage and revoke connections.