OAuth apps

Register an OAuth app on the Ionhour developer platform — client types, one-time credentials, configuration, and the full review and distribution lifecycle.

An OAuth app is your product's identity inside Ionhour: its credentials, the scopes it may request, its webhook subscriptions, and its listing in the app directory.

Creating an app

In the Developer Console, choose Create app. Two decisions up front:

Name (2–80 characters) — shown on the consent screen and in the directory. You can change it later.
Client type — immutable after creation:

Client type	For	Secret
Confidential	Server-side apps that can keep a secret	Gets a `client_secret` (`ionh_sec_…`)
Public	CLIs, mobile apps, SPAs	No secret — PKCE (`S256`) is mandatory

Creating an app records your acceptance of the developer terms.

Credentials — shown once

Immediately after creation you get, one time only:

Credential	Prefix	Notes
Client ID	`ionh_app_`	Public identifier — safe to embed
Client secret	`ionh_sec_`	Confidential apps only; hashed at rest, unrecoverable
Webhook signing secret	`ionh_whsec_`	Signs every delivery — see Webhooks

Store secrets in a secret manager before closing the dialog. They cannot be retrieved again — only rotated from the app's Overview (client secret) and Webhooks (signing secret) tabs. A rotated client secret invalidates the old one immediately; a rotated webhook secret keeps the previous one valid for 24 hours so you can roll deployments without dropping verification.

Configuration

Authorization — up to 5 callback URLs. They must be https and are matched exactly (no wildcards, no path prefixes).
Permissions — request scopes per product API; see Scopes.
Webhooks — a delivery endpoint plus per-event subscriptions; see Webhooks.

Distribution lifecycle

Status	Meaning
Draft	Private — only workspaces you belong to can install it. Develop and test here.
In review	Submitted; the review team typically responds within 2–3 business days.
Published	Listed in the Ionhour app directory; any workspace can install it.
Rejected	Changes requested — the reviewer's notes appear on the Distribution tab; fix and resubmit.
Suspended	Suspended by Ionhour; installs stop and existing installations are paused. Contact support.

Before you can submit, the Overview tab's readiness checklist must be green on three items: display information complete (description plus the compliance details — vendor name, customer support contact, privacy policy URL, terms of service URL, and a declaration of whether the app stores personal data), at least one callback URL, and at least one requested scope.

Re-review rule. Changing a published app's scopes or event subscriptions returns it to In review — the change goes live after re-approval, and existing installations keep their current grants until then. Everything else (name, description, callback URLs, webhook endpoint) updates without re-review.

Deleting an app

Deletion is permanent: it revokes every installation and all issued tokens. Published apps must be suspended before they can be deleted.