v1/mgmt/thirdparty/app/createAuthorization
Descope Project ID and Management Key Project ID:Management Key as bearer token.
In: header
Request Body
application/json
string backChannelLogoutUrl = 10 [(validate).string = {url: true, optional: true}];
Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.
{
"attribute-key": "attribute-value"
}JAR (JWT-Secured Authorization Request, RFC 9101) settings for Third Party Applications
scopeClaimMapping is the structured scope→claim model. Consumed by CreateThirdPartyApplicationV2 (v2 write-replace: attributesScopes is ignored/cleared). v1 ignores this field.
clientAuthMethod: "clientSecret" (default when empty), "privateKeyJwt" (only clientAssertions are accepted), "workloadIdentity" (only workloadClientAssertions are accepted) or "mtls" (only a registered mTLS certificate is accepted).
clientAssertions are the private_key_jwt trust entries (JWKS URL or PEM public key per entry).
workloadClientAssertions are the workload identity trust entries (SPIFFE trust domain or OIDC issuer per entry).
authorizationCodeDisabled rejects the authorization_code grant for this app, including its authorization requests. Default false.
clientCredentialsDisabled rejects the client_credentials grant for this app. Default false. A public client cannot use this grant.
refreshTokenDisabled rejects the refresh_token grant for this app, so its tokens cannot be refreshed. Default false.
jwtBearerDisabled rejects the JWT bearer grant (urn:ietf:params:oauth:grant-type:jwt-bearer) for this app. Default false. A public client cannot use this grant.
deviceCodeDisabled rejects the device authorization grant (urn:ietf:params:oauth:grant-type:device_code) for this app. Default false.
tokenExchangeDisabled rejects the token exchange grant (urn:ietf:params:oauth:grant-type:token-exchange) for this app. Default false.
cibaEnabled allows the CIBA grant (urn:openid:params:grant-type:ciba) for this app and requires cibaSettings. Default false. A public client cannot use this grant.
Create a new third party application, using a valid management key.
curl -X POST "https://api.descope.com/v1/mgmt/thirdparty/app/create" \ -H "Content-Type: application/json" \ -d '{}'{ "id": "string", "cleartext": "string", "clientId": "string"}export interface Response {id?: stringcleartext?: stringclientId?: string}