Create client credentials

Client credentials give your Marketplace app access to a Sitecore user token. During app configuration, you must create client credentials if you decided to use custom authorization.

To create client credentials for your app:

  1. In the Cloud Portal, click App studio > Studio, then click the app you want to configure.

  2. In the Client credentials section, click Create and then select your app type:

    • Single-page app (SPA) - the credential consists of a client ID. Ideal for React apps, and Next.js apps using client-side authentication (@auth0/auth0-react) when created in the Marketplace SDK CLI quick start template.

    • Regular web app - the credentials consist of a client ID and a client secret. Ideal for Next.js apps using server-side authentication such as @auth0/nextjs-auth0, and other multi-page apps.

    Note

    For every Marketplace app, you can create a maximum of two sets of client credentials per app type. This is useful if, for example, you decide to rotate credentials.

    After creating a set of credentials, you can revoke them in the Client credentials section by clicking Settings > Revoke access.

  3. In the Create credentials dialog, in the Alias field, enter a descriptive name for the credentials. You can change this value any time.

  4. Optionally, in the Authorization URLs section, specify one or more comma-separated URLs for the following fields. You can change this value any time.

    • Allowed callback URLs - the URLs the user can be redirected to after logging in. Specifying multiple URLs is useful for handling different environments, such as QA and testing.

    • Allowed logout URLs - the URLs the user can be redirected to after logging out.

    • Allowed origin URLs - additional origins allowed to make cross-origin resource sharing (CORS) requests.

    • Allowed web origin URLs - allowed origins for use with cross-origin authentication.

    Important

    The authorization URLs must correspond to the deployment URL, and the localhost URL or custom DNS you develop your app on.

    Consider the following deployment and localhost URLs:

    • Deployment URL - https://my-app.com

    • Localhost URL - https://localhost:3002

    • Custom DNS - https://myapp.local:3000

    Corresponding authorization URLs could include:

    • Allowed callback URLs - https://my-app.com, https://my-app.com/auth/callback, https://localhost:3002, https://localhost:3002/auth/callback, https://myapp.local:3000, https://myapp.local:3000/auth/callback

    • Allowed logout, allowed origin, and allowed web origin URLs - https://my-app.com, https://localhost:3002, https://myapp.local:3000

  5. Click Create credentials. For single-page apps, a client ID appears. For regular web apps, a client secret and client ID appear.

  6. Copy the credentials. You'll use them during development, in your .env file.

    You can view the client ID later, after creating the credentials, but you won't be able to view the client secret after closing the modal.

  7. Click Done.

  8. Depending on your app type:

    • If building a custom app - return to app configuration to activate your app.

    • If building a public app - return to app configuration, then install your app for local development.

Note

After creating client credentials, you can view the client ID, change the alias, and change the authorization URLs any time in the Client credentials section by clicking Settings > Edit .

For example, if you don't know your app's production URL in the beginning of development, you might first include only localhost URLs in the list of authorization URLs. Later, when you have a production URL, you can update the authorization URLs to include the new values.

Auth0 authorization flow for Marketplace applications that replaces the built-in authorization managed by the Marketplace SDK. Required if your app needs to make server-side API calls to SitecoreAI APIs.

Do you have some feedback for us?

If you have suggestions for improving this article,