Register an application
Every application that signs users in with Raha Account needs a registered client. Any Raha Account user can create and manage their own developer applications from the account portal.
Create the application
- Sign in to Raha Account and open Developer applications.
- Create a new application and enter its name.
- Add between one and twenty redirect URIs.
- Optionally add display and policy metadata, scopes, and post-logout redirect URIs.
- Save the application and copy its
client_id. If a client secret is shown, store it securely right away.
Application settings
| Setting | Notes |
|---|---|
client_name | Required. Shown to users on the consent screen and in their list of connected applications. |
redirect_uris | Required, 1–20 entries. Raha Account compares them exactly, including scheme, host, port, and path. |
post_logout_redirect_uris | Up to 20 entries. Where users may return after logout. |
scopes | Scopes the application is allowed to request. |
client_uri | Your application's home page. |
logo_uri | Logo shown on hosted pages. |
tos_uri, policy_uri | Terms of service and privacy policy links shown to users. |
The client ID, client secret, grant types, response types, and token endpoint authentication method are managed by Raha Account and cannot be set directly.
Redirect URI rules
- Use HTTPS for production redirect URIs.
- Register a separate redirect URI for each environment rather than reusing production URIs during development.
- Do not use wildcards or open redirects. The
redirect_uriin an authorization request must match a registered value exactly.
Protecting client secrets
Treat a client secret like a password. It is only for confidential clients running on a server you control. Never embed it in a browser bundle, mobile app, or CLI binary; those are public clients and must rely on PKCE instead.
Access to protected resources
Signing users in only requires a registered application. Machine access to protected resources such as the account directory also requires Raha Account administrators to grant your application the resource and assign users to it. Contact Raha Account support with your client_id to request access.
When users disconnect your application
Users can revoke your application from their Raha Account at any time. After that, refresh tokens stop working and access tokens are rejected. Handle invalid_grant on refresh by signing the user in again.