Optional: import an existing OIDC client. Both are accepted on create only (immutable afterward); empty means the client_id is computed and the client_secret is generated server-side. The client_id must be unique within the project. The client_secret is returned once on the create response.

Default audience policy for issued tokens. Applies only to modern apps (non-empty clientType): 'projectId', 'clientId', 'appId', empty (both), or 'empty' (no aud at all). Legacy apps are unaffected. Mirrors third-party apps.

trustedAppIds lists sibling SSO apps whose roles are included in this app's JWT under the trustedApps claim at login time. Apps where the user has no roles are silently omitted.

Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.

Audience policy applied to trusted sibling apps' identifiers when appended to the issued token's aud (see trustedAppIds). Same value set as defaultAudience: 'projectId' / 'clientId' / 'appId' / empty (=both) / 'empty' (add none). Independent of defaultAudience.

serviceAccountRoles assigns this app (when client_credentials is enabled) application-roles in its trusted apps; surfaced in its client_credentials token under the app.trustedApps claim.