> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-findings-decoys-followup.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Create Client > CreateClient mints an additional App-owned OAuth client for an OIDC application. C1 generates the client ID and any confidential-client secret. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/apps/{app_id}/sso/applications/{id}/clients openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/apps/{app_id}/sso/applications/{id}/clients: post: tags: - SSO summary: Create Client description: |- CreateClient mints an additional App-owned OAuth client for an OIDC application. C1 generates the client ID and any confidential-client secret. operationId: c1.api.sso.v1.SSOApplicationService.CreateClient parameters: - in: path name: app_id required: true schema: description: Application that owns the SSO application. type: string - in: path name: id required: true schema: description: SSO application that will govern this client. type: string requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.sso.v1.SSOApplicationServiceCreateClientRequestInput responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.sso.v1.SSOApplicationServiceCreateClientResponse description: >- SSOApplicationServiceCreateClientResponse contains the generated client and its one-time secret, when applicable. components: schemas: c1.api.sso.v1.SSOApplicationServiceCreateClientRequestInput: description: |- SSOApplicationServiceCreateClientRequest mints an additional App-owned client. The caller supplies configuration, never a client ID. properties: client: oneOf: - $ref: >- #/components/schemas/c1.api.sso.v1.SSOApplicationOIDCClientConfig - type: 'null' required: - client title: Sso Application Service Create Client Request type: object x-speakeasy-name-override: SSOApplicationServiceCreateClientRequest c1.api.sso.v1.SSOApplicationServiceCreateClientResponse: description: >- SSOApplicationServiceCreateClientResponse contains the generated client and its one-time secret, when applicable. properties: client: oneOf: - $ref: '#/components/schemas/c1.api.sso.v1.SSOApplicationOIDCClient' - type: 'null' clientSecret: description: |- Returned once for client_secret_basic/client_secret_post; empty for none/private_key_jwt. type: string title: Sso Application Service Create Client Response type: object x-speakeasy-name-override: SSOApplicationServiceCreateClientResponse c1.api.sso.v1.SSOApplicationOIDCClientConfig: description: >- SSOApplicationOIDCClientConfig is the administrator-supplied configuration from which C1 mints an App-owned OAuth client. The client ID is never input. properties: authentication: oneOf: - $ref: >- #/components/schemas/c1.api.sso.v1.SSOApplicationOIDCClientAuthentication - type: 'null' displayName: description: Human-readable client name shown to administrators. type: string pkcePolicy: description: >- PKCE is required by default on create. On update, UNSPECIFIED preserves the current policy; set REQUIRED_S256 explicitly to tighten a legacy confidential client. enum: - SSO_APPLICATION_OIDC_PKCE_POLICY_UNSPECIFIED - SSO_APPLICATION_OIDC_PKCE_POLICY_REQUIRED_S256 - SSO_APPLICATION_OIDC_PKCE_POLICY_ALLOW_MISSING_FOR_LEGACY type: string x-speakeasy-unknown-values: allow redirectUris: description: >- Exact redirect URIs the client may use after authorization. HTTPS and loopback HTTP are accepted; public clients may also use a reversed-DNS private-use scheme for native-app redirects. items: type: string type: - array - 'null' required: - displayName - authentication title: Sso Application Oidc Client Config type: object x-speakeasy-name-override: SSOApplicationOIDCClientConfig c1.api.sso.v1.SSOApplicationOIDCClient: description: SSOApplicationOIDCClient is an App-owned OAuth client minted by C1. properties: appId: description: Application that owns this client. type: string authentication: oneOf: - $ref: >- #/components/schemas/c1.api.sso.v1.SSOApplicationOIDCClientAuthentication - type: 'null' clientId: description: Client ID generated by ConductorOne. type: string createdAt: format: date-time type: - string - 'null' displayName: description: Human-readable client name. type: string pkcePolicy: description: Effective PKCE policy. enum: - SSO_APPLICATION_OIDC_PKCE_POLICY_UNSPECIFIED - SSO_APPLICATION_OIDC_PKCE_POLICY_REQUIRED_S256 - SSO_APPLICATION_OIDC_PKCE_POLICY_ALLOW_MISSING_FOR_LEGACY type: string x-speakeasy-unknown-values: allow redirectUris: description: Exact callback URLs registered for this client. items: type: string type: - array - 'null' ssoApplicationId: description: SSO application whose identity policy applies to this client. type: string updatedAt: format: date-time type: - string - 'null' title: Sso Application Oidc Client type: object x-speakeasy-name-override: SSOApplicationOIDCClient c1.api.sso.v1.SSOApplicationOIDCClientAuthentication: description: > SSOApplicationOIDCClientAuthentication is the exact token-endpoint client authentication method assigned to an OIDC client. This message contains a oneof named method. Only a single field of the following list may be set at a time: - none - clientSecretBasic - clientSecretPost - privateKeyJwt properties: clientSecretBasic: oneOf: - $ref: >- #/components/schemas/c1.api.sso.v1.SSOApplicationOIDCClientAuthClientSecretBasic - type: 'null' clientSecretPost: oneOf: - $ref: >- #/components/schemas/c1.api.sso.v1.SSOApplicationOIDCClientAuthClientSecretPost - type: 'null' none: oneOf: - $ref: >- #/components/schemas/c1.api.sso.v1.SSOApplicationOIDCClientAuthNone - type: 'null' privateKeyJwt: oneOf: - $ref: >- #/components/schemas/c1.api.sso.v1.SSOApplicationOIDCClientAuthPrivateKeyJWT - type: 'null' title: Sso Application Oidc Client Authentication type: object x-speakeasy-name-override: SSOApplicationOIDCClientAuthentication c1.api.sso.v1.SSOApplicationOIDCClientAuthClientSecretBasic: description: RFC 6749 client_secret_basic. C1 generates and returns the secret once. title: Sso Application Oidc Client Auth Client Secret Basic type: object x-speakeasy-name-override: SSOApplicationOIDCClientAuthClientSecretBasic c1.api.sso.v1.SSOApplicationOIDCClientAuthClientSecretPost: description: RFC 6749 client_secret_post. C1 generates and returns the secret once. title: Sso Application Oidc Client Auth Client Secret Post type: object x-speakeasy-name-override: SSOApplicationOIDCClientAuthClientSecretPost c1.api.sso.v1.SSOApplicationOIDCClientAuthNone: description: Public client authentication. No client credential is issued. title: Sso Application Oidc Client Auth None type: object x-speakeasy-name-override: SSOApplicationOIDCClientAuthNone c1.api.sso.v1.SSOApplicationOIDCClientAuthPrivateKeyJWT: description: >- RFC 7523 private_key_jwt using an inline RFC 7517 JWK Set. Multiple public signing keys allow overlap during relying-party key rotation; C1 selects by the assertion's `kid`. The relying party retains every private key. properties: publicJwks: description: The publicJwks field. format: base64 type: string required: - publicJwks title: Sso Application Oidc Client Auth Private Key Jwt type: object x-speakeasy-name-override: SSOApplicationOIDCClientAuthPrivateKeyJWT securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````