OAuth clients & resource servers

Written for: ＋ Written for
Deprecated: ＋ Deprecated
Applies to: ＋ Applies to

AdminUpdated Sep 11, 2026

OAuth clients & resource servers

Atlas can be an OAuth/OpenID provider — "Sign in with Atlas". You register the third-party (or first-party) apps that authenticate against your instance as OAuth clients, and the machine-to-machine APIs they call as resource servers. The protocol endpoints those clients hit are documented under OpenID Connect & OAuth2.

OAuth clients

{
  "object": "oauth_client",
  "id": "oac_…",
  "client_id": "atlas_client_…",
  "name": "Acme Web",
  "redirect_uris": ["https://acme.com/callback"],
  "allowed_scopes": ["openid", "profile", "email"],
  "grant_types": ["authorization_code", "refresh_token"],
  "token_endpoint_auth_method": "client_secret_basic",
  "is_public": false,
  "first_party": true,
  "created_at": 1757000000000,
  "updated_at": 1757600000000
}

Method & path	Scope	Notes
`GET /v1/oauth_clients`	`oauth_clients:read`	Secret never returned
`POST /v1/oauth_clients`	`oauth_clients:write`	Register a confidential or public (PKCE) client. A confidential client's secret is revealed once. idempotent
`GET /v1/oauth_clients/:id`	`oauth_clients:read`	Never the secret
`PATCH /v1/oauth_clients/:id`	`oauth_clients:write`	Update name/redirect_uris/scopes (secret immutable here). idempotent
`POST /v1/oauth_clients/:id/rotate_secret`	`oauth_clients:write`	Rotate; new secret revealed once. idempotent
`DELETE /v1/oauth_clients/:id`	`oauth_clients:write`	Delete; codes + grants cascade. idempotent

Client → resource-server grants (client credentials)

Method & path	Scope
`GET /v1/oauth_clients/:clientId/grants`	`oauth_clients:read`
`POST /v1/oauth_clients/:clientId/grants`	`oauth_clients:write`
`DELETE /v1/oauth_clients/:clientId/grants/:grantId`	`oauth_clients:write`

Resource servers (M2M APIs)

An API you protect with Atlas-issued access tokens: an audience identifier, its scopes, and a token TTL.

Method & path	Scope	Notes
`GET /v1/resource_servers`	`resource_servers:read`	List APIs + scopes
`POST /v1/resource_servers`	`resource_servers:write`	Register (audience, scopes, TTL)
`GET /v1/resource_servers/:id`	`resource_servers:read`
`PATCH /v1/resource_servers/:id`	`resource_servers:write`	Identifier (audience) is immutable
`DELETE /v1/resource_servers/:id`	`resource_servers:write`	Client grants cascade

Example

// Register a confidential client — capture the one-time secret
const client = await atlas.oauthClients.create({
  name: 'Acme Web',
  redirect_uris: ['https://acme.com/callback'],
  allowed_scopes: ['openid', 'profile', 'email'],
});
console.log(client.client_id, client.client_secret); // secret shown once

// Register an API and authorize the client for it (client_credentials)
const api = await atlas.resourceServers.create({ /* identifier, scopes, ttl */ } as any);
await atlas.oauthClients.grants.create(client.id, { resource_server_id: api.id, scopes: ['reports:read'] });

Clients then run the standard flows at /oauth2/authorize and /oauth2/token; verify access tokens at /oauth2/introspect or against the JWKS. See OpenID Connect & OAuth2.

Was this page helpful?