Create OAuth client (authorization code grant)

Overview

Create a Passport authorization-code grant OAuth client (name + redirect URLs) owned by the authenticated user. This app acts as an OAuth Identity Provider. The plaintext client_secret comes back once, on creation only — it is hashed at rest (Passport v13) and can never be retrieved later. Emits audit OAUTH_CLIENT_CREATED.

Prerequisites

• A bearer token in the Authorization header.

Base URL

Endpoint

POST /api/v1/sso/create/client

Authentication

• Requires a bearer token in the Authorization: Bearer <bearer-token> header.

• bearer token.

• The route file groups SSO client management under admin/super-admin, but the controller enforces owner-scoping.

• The creating user owns the client, and only its creator may view / update / delete it.

Rate limit

• No rate limit.

Request body

{
  "name": "My App",
  "redirect_callback": [
    "https://example.com/callback"
  ]
}

How it works

• 200 with client_id, one-time client_secret, and the echoed redirect_callback. 422 on validation failure; 500 on unexpected error.

Response

200 OK · 200

{
  "data": {
    "client_id": "019eeeca-2288-73a4-ac88-7c3f105bcc22",
    "client_secret": "<client-secret>",
    "redirect_callback": [
      "https://example.com/callback"
    ]
  }
}

422 Validation error · 422

{
  "message": "The name field is required.",
  "errors": {
    "name": [
      "The name field is required."
    ],
    "redirect_callback": [
      "The redirect callback field is required."
    ]
  }
}

401 Unauthenticated · 401

{
  "message": "Unauthenticated."
}

Errors

Example request

curl --request POST \
  --url "https://production-api.shoutaboutus.com/api/v1/sso/create/client" \
  --header 'Authorization: Bearer <bearer-token>' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"name": "My App", "redirect_callback": ["https://example.com/callback"]}'