> For the complete documentation index, see [llms.txt](https://gitbook.humanode.io/oauth2-service/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.humanode.io/oauth2-service/oauth-2/oauth-2-client.md).

# OAuth 2 Client

OAuth 2 Client is an application making protected resource requests on behalf of the resource owner and with its authorization.

## Client Registration

Before initiating the authorization process, the client registers with the authorization server. As a result of a registration client acquires required credentials, such as client identifier and client password (optional).

## Essential Client Data

Client identifier - a unique to the authorization server string representing the registration information provided by the client.

Authentication method - the method for the client authentication. Can be set to one of the following:

* none - client do not need to authenticate;
* client\_secret\_basic - password should be send in the request header;
* client\_secret\_post - password should be send in the request body;
* private\_key\_jwt - signed by the client JWT should be send.

Client password - the secret for client authentication. Required when authentication method is client\_secret\_basic or client\_secret\_post.

JWKs URL - the URL with client public keys. Required for private\_key\_jwt authentication method and used for validate client JWT.

Redirect URLs - allowed callbacks for authorization requests. Multiple URLs can be set and one of them should be used when constructing authorization request.

Scopes - allowed scopes of the access. While the client has all allowed scopes, authorization requests could have any combination of them.

Response types - allowed response types. They can be:

* implicit - authorization server issuing Access Token after authorization process;
* authorization code - authorization server issuing authorization code which can be exchanged for Access Token via separate request.

{% hint style="info" %}
Implicit flow doesn't support Refresh Tokens and generally is not recommended due to security reasons.
{% endhint %}

Grant types - allowed grant types. For authorization code flow usually set to authorization\_code for getting the code and refresh\_token for refreshing tokens.

## Visual Data

{% hint style="info" %}
This data is shown to end-user during their login flow (optionally) and consent flow (strongly recommended).
{% endhint %}

Client name - human-readable client name, usually project or company name.

Logo - URL with client logo.

## Legal Data

Client may store URLs to Privacy and/or Terms Of Service pages.

## Information about client owner

This includes owner name in human-readable form and list of contacts.

![](https://3702472699-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr9BYcyYNSxAhS6VoH9d2%2Fuploads%2FvF5F9IXX93DCTMpILkvT%2FClient.png?alt=media\&token=bc64d21a-6aad-4816-9984-5ea2f35fb18c)