--- type: Documentation title: OAuth clients for integrations description: When a connector needs an OAuth client, how an administrator creates it, rotates the client secret and revokes the client, and what users see of it. resource: https://www.librario.de/en/docs/integration/oauth tags: - docs - integration --- # OAuth clients for integrations > **Plan option:** > > Available in plans with **advanced MCP controls**. [Compare plans→](/en/preise) An OAuth client is the credential an application presents to Librario. This page shows when you have to issue one, which values the connector needs, and how to rotate the client secret without dropping the connection. ## Two levels OAuth shows up on two levels in Librario. Keeping them apart makes every setting easy to find. **Per user: the connection.** Every connection is authorised by an individual on the consent screen. It appears on that person's Integrations page under "Connected applications", where they can revoke it themselves at any time. That holds both for tools that register themselves (Claude, ChatGPT) and for clients an administrator issued. The permissions granted never exceed what the client allows. **Per account: the client.** An administrator issues the client under **Account → OAuth clients** and manages it there: client ID, client secret, callback URLs, surface, allowed permissions and PKCE . Revoking the client ends every user's connection at once. ![The "Connected applications" card on a user's Integrations page with two connections: "Copilot Studio (Manual)" with the AI assistant badge and "Librario CLI" with the REST API badge, each with the connect and last-used times, the granted permissions and a Revoke button.](/de/docs/integration/oauth/verbindungen.webp) _A user's connections on their Integrations page, among them the one to a client an administrator issued._ How users check and revoke their connections is described under [Manage and revoke connections](/en/docs/integration/mcp#manage-and-revoke-connections). The rest of this page covers the account level. ## When you need an OAuth client Claude, ChatGPT and other MCP tools register with Librario on their own. You issue nothing for them; they appear on the respective user's Integrations page after the first sign-in. You need an OAuth client in two cases: - **Connectors with manual OAuth configuration.** Copilot Studio ("Manual" type) and Gemini Enterprise ask for a client ID and client secret before they connect. - **Your own scripts against the REST API.** A script that cannot use self-registration gets its client here, for the "REST API" surface. The page is part of advanced MCP controls and needs a plan that includes them; self-registration does not. It requires the administrator role on top of REST API or MCP access, independently of who may see the rest of the account settings. ## Create a client ![The "New OAuth client" form with the fields name, callback URLs, surface (AI assistants or REST API), the permissions for AI assistants and the checked "Require PKCE" box.](/de/docs/integration/oauth/client-anlegen.webp) _The form for a new OAuth client._ 1. Open **Account → OAuth clients** and click **New OAuth client**. 2. **Name:** appears on the consent screen and on the Integrations page of every user who authorises the client. 3. **Callback URLs:** exactly as the connector shows them. https only; plain http only on a loopback address (`127.0.0.1`, `[::1]`) or on `localhost` with an explicit port, in every case without a fragment and without credentials. Use **Add callback URL** to enter more. 4. **Surface:** "AI assistants (MCP)" for connectors, "REST API" for scripts. 5. **Permissions:** what the client may request at most. A user can grant less when authorising, never more. 6. **Require PKCE:** leave it on whenever the connector supports PKCE. Copilot Studio in manual configuration sends no `code_challenge`; switch PKCE off there. For Gemini Enterprise leave it on; if the connector reports at sign-in that the `code_challenge` parameter is required, it sends none, and you create the client again without PKCE. Switching it off is recorded. If creation fails, the form comes back with the problems marked. The usual causes: a callback URL with plain http outside the loopback addresses, `localhost` without a port, a fragment or credentials in the URL, or no permission ticked at all. ## Enter the values in the connector ![The one-time page with the values of an OAuth client right after creation: the notice that the client was created and the client secret is shown only once, then client ID, client secret, authorization URL, token URL, resource, scopes and the registered callback URLs, each with a copy button.](/de/docs/integration/oauth/client-secret-anzeigen.webp) _Every value a connector asks for, right after the client was created._ After creation Librario shows every value a connector asks for. This page opens only once, not even with Back or Reload. Copy every value in one go. | Value | What it is for | | --- | --- | | Client ID | The client's identifier. Stays on the list afterwards. | | Client secret | The client's password. Shown only here; afterwards it can only be replaced by a new one. | | Authorization URL | Where the connector sends the user to sign in. Already carries the `resource` parameter. | | Token URL and refresh URL | The same endpoint answers code exchange and token refresh. If the connector asks for both, enter the same URL. | | Resource (`resource`) | The surface Librario issues access tokens for. | | Scopes | The permissions the connector requests, separated by spaces. | | Registered callback URLs | If the connector shows a different one after saving, create the client again with that URL. | ## Manage client secrets ![The OAuth clients list with two entries, each with its surface, PKCE badge, Client ID and permissions. "Gemini Enterprise" carries the green "PKCE" badge and shows its two client secrets expanded, the older one expiring in 7 days. "Copilot Studio (Manual)" carries the amber "No PKCE" badge and shows its only client secret collapsed to one line. On narrow screens a green or amber shield icon stands in for the PKCE word.](/de/docs/integration/oauth/clients-liste.webp) _A client in the middle of a client secret rotation, below it a client where everything is fine._ The list shows each client's Client ID, surface, allowed permissions and whether it requires PKCE: the green "PKCE" badge or the amber "No PKCE" badge, a green or amber shield icon on narrow screens. Below sit its valid client secrets, recognisable by their first characters, and for each when it was created, last used and expires. At most two are valid at a time. As long as everything is fine, the **Client secrets** section stays collapsed to a one-line summary. When a client secret has an expiry date, or when the client has no valid client secret left at all, the section opens by itself. In the second case the client's row also carries the amber badge "No valid client secret". ### Rotate a client secret ![The "Copilot Studio (Manual)" entry in the OAuth clients list with its "Client secrets" section expanded: its only client secret, created 9 days ago, never used and without an expiry date, with a Retire button; below it the form for a new client secret with a "Label (optional)" field reading "Rotation Okt 2026", the choice "Keep the current one for 7 days" and the button "New client secret".](/de/docs/integration/oauth/client-secret-ausstellen.webp) _A new client secret with a seven-day window for the previous one._ 1. Expand **Client secrets** and, if you like, give the new secret a label, such as the reason for the rotation. 2. Choose what happens to the current client secret: **retire now** (the default), or keep it for another 24 hours, 7 days or 30 days. That window is the time you have to enter the new client secret in the connector without it losing its connection. 3. Click **New client secret**. Librario shows the new one as it did at creation, exactly once. 4. Enter it in the connector. The last use of the two entries tells you whether the connector has switched to the new one yet. 5. Once it has, retire the previous one early with **Retire**. Otherwise it stops working on its own at the expiry date. While two client secrets are valid, the list hides the form until you have retired one. Issuing and retiring are both recorded. ### A compromised client secret If a client secret has ended up in a repository, a chat transcript or an email, act at once: - Issue a **New client secret** with **retire now** if the connector should carry on right away. Then enter the new client secret in the connector. - Or **Retire** the affected entry. That works on a client's only client secret too; the client then has no valid client secret, and the connector gets no token until you issue one with **New client secret**. Either way a connector presenting the old client secret gets no token from now on. The client and every user's connection stay; they carry on as soon as the connector uses a new client secret. ## Revoke a client **Revoke** ends every connection of a client immediately, for every user who authorised it. The consents are kept for audit purposes. The client disappears from the list; note the client ID beforehand if you might need it for an audit later. Revoke a client when the connector is being shut down or is no longer trusted. If only a client secret is at stake, rotate the client secret; the connections stay. ## Further reading - Endpoints, PKCE, scopes and self-registration (Dynamic Client Registration): [REST API](/en/docs/integration/api#authentication). - The steps inside Copilot Studio and Gemini Enterprise: [Connect AI assistants (MCP)](/en/docs/integration/mcp#manual-oauth-configuration). - How users revoke their connections: [Manage and revoke connections](/en/docs/integration/mcp#manage-and-revoke-connections).