How the app authenticates as an OAuth client. 'confidential': a dedicated client ID and client secret, for server-side apps. 'public': a dedicated client ID and PKCE with no secret, for native, mobile and single-page apps. These apps normally use the project-level issuer and discovery endpoints. On create, an empty clientType means the legacy Access Key type (the project ID is the client ID, and the issuer and discovery endpoints are per app); accounts that can't use the legacy type get 'confidential' instead. On update, an empty clientType keeps the app's current type.

Optional: import an existing OIDC client. Both are accepted on create only (immutable afterward); empty means the client_id is computed and the client_secret is generated server-side. The client_id must be unique within the project. The client_secret is returned once on the create response.

Default audience policy for issued tokens. Applies only to modern apps (non-empty clientType): 'projectId', 'clientId', 'appId', empty (both), or 'empty' (no aud at all). Legacy apps are unaffected. Mirrors third-party apps.

trustedAppIds lists sibling SSO apps whose roles are included in this app's JWT under the trustedApps claim at login time. Apps where the user has no roles are silently omitted.

Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.

Audience policy applied to trusted sibling apps' identifiers when appended to the issued token's aud (see trustedAppIds). Same value set as defaultAudience: 'projectId' / 'clientId' / 'appId' / empty (=both) / 'empty' (add none). Independent of defaultAudience.

serviceAccountRoles assigns this app (when client_credentials is enabled) application-roles in its trusted apps; surfaced in its client_credentials token under the app.trustedApps claim.

assignedRoleIds lists project-level roles that grant access to this application. A user holding any of them can access it, in addition to users assigned directly or through their tenant. Additive: it never removes access, so it only changes the outcome for projects that deny applications by default. Tenant scoped roles are rejected.

Require a valid DPoP proof (RFC 9449) at the token endpoint. Applies to Confidential/Public clients; legacy apps (empty clientType) are exempt. Defaults to false.