> ## Documentation Index
> Fetch the complete documentation index at: https://developers.pleo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Register an OAuth 2.0 Client

export const WhatComesNext = ({children, href}) => <div className="mt-4">
    <a href={href} className="btn-primary">
      {children} →
    </a>
  </div>;

export const WarningCallout = ({title, children}) => <div className="callout-box callout-warning">
    <div className="callout-row">
      <span className="callout-badge">
        <svg width="18" height="18" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="currentColor"><path d="M215.46,216H40.54C27.92,216,20,202.79,26.13,192.09L113.59,40.22c6.3-11,22.52-11,28.82,0l87.46,151.87C236,202.79,228.08,216,215.46,216Z" opacity="0.2" /><path d="M236.8,188.09,149.35,36.22h0a24.76,24.76,0,0,0-42.7,0L19.2,188.09a23.51,23.51,0,0,0,0,23.72A24.35,24.35,0,0,0,40.55,224h174.9a24.35,24.35,0,0,0,21.33-12.19A23.51,23.51,0,0,0,236.8,188.09ZM222.93,203.8a8.5,8.5,0,0,1-7.48,4.2H40.55a8.5,8.5,0,0,1-7.48-4.2,7.59,7.59,0,0,1,0-7.72L120.52,44.21a8.75,8.75,0,0,1,15,0l87.45,151.87A7.59,7.59,0,0,1,222.93,203.8ZM120,144V104a8,8,0,0,1,16,0v40a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,180Z" /></svg>
      </span>
      <div>
        {title && <div className="callout-title">
            {title}
          </div>}
        <div className="callout-body">
          {children}
        </div>
      </div>
    </div>
  </div>;

export const RememberCallout = ({title, children}) => <div className="callout-box callout-remember">
    <div className="callout-row">
      <span className="callout-icon">
        <svg width="22" height="22" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="currentColor"><path d="M229.66,98.34,172.39,155.8c11.46,22.93-1.72,45.86-10.11,57a8,8,0,0,1-12,.83L42.34,105.76A8,8,0,0,1,43,93.85c29.65-23.92,57.4-10,57.4-10l57.27-57.46a8,8,0,0,1,11.31,0L229.66,87A8,8,0,0,1,229.66,98.34Z" opacity="0.2" /><path d="M235.32,81.37,174.63,20.69a16,16,0,0,0-22.63,0L98.37,74.49c-10.66-3.34-35-7.37-60.4,13.14a16,16,0,0,0-1.29,23.78L85,159.71,42.34,202.34a8,8,0,0,0,11.32,11.32L96.29,171l48.29,48.29A16,16,0,0,0,155.9,224c.38,0,.75,0,1.13,0a15.93,15.93,0,0,0,11.64-6.33c19.64-26.1,17.75-47.32,13.19-60L235.33,104A16,16,0,0,0,235.32,81.37ZM224,92.69h0l-57.27,57.46a8,8,0,0,0-1.49,9.22c9.46,18.93-1.8,38.59-9.34,48.62L48,100.08c12.08-9.74,23.64-12.31,32.48-12.31A40.13,40.13,0,0,1,96.81,91a8,8,0,0,0,9.25-1.51L163.32,32,224,92.68Z" /></svg>
      </span>
      <div>
        {title && <div className="callout-title">
            {title}
          </div>}
        <div className="callout-body">
          {children}
        </div>
      </div>
    </div>
  </div>;

Registering an OAuth 2.0 client allows Pleo to identify your application, apply the correct redirect and scope configuration, and issue client credentials (**Client ID** and **Client Secret**) securely.

This how-to covers **advanced registration**, where you manage redirects and the access-token lifecycle yourself. For a simpler setup using Postman, see the [How to Register an OAuth 2.0 Client (Postman)](/docs/current/how-tos/oauth-postman/how-to-register-an-oauth-client-postman) article instead.

## Prerequisites

Before you begin:

* You are in the process of onboarding to Pleo’s [Staging environment](/docs/current/how-tos/environment-access/how-to-get-access-to-staging-oauth).
* Pleo has asked you to complete the **Developer Partner Registration** form.
* This how-to provides the **information** you need to submit in the registration form.

## Steps

### 1. Provide Registration Data

You provide information to Pleo in the following categories.

#### Human-Readable Information

<WarningCallout title="Warning">
  Do not use Pleo branding or claim your app is a Pleo client.
</WarningCallout>

This information is shown to end users during authorisation:

| Parameter        | Description                                                 |
| ---------------- | ----------------------------------------------------------- |
| Client Name      | Your application’s brand name.                              |
| Client URI       | Link to your app homepage or integration announcement page. |
| Logo             | Square image (1:1 ratio) representing your application.     |
| Terms of Service | Link to the legal agreement governing use of your app.      |
| Privacy Policy   | Link explaining how user data is collected and processed.   |
| Contacts         | Email addresses for people responsible for the application. |

#### Pleo-Specific Information

This information allows Pleo to integrate your application into the product:

| Parameter      | Description                                              |
| -------------- | -------------------------------------------------------- |
| Initiation URI | Where users start connecting your app to Pleo.           |
| Settings URI   | Where users manage your app’s settings from within Pleo. |

#### Technical Information

Required details to establish a secure OAuth 2.0 flow for **your registered OAuth 2.0 client**:

| Parameter               | Description                                                                                                          |
| ----------------------- | -------------------------------------------------------------------------------------------------------------------- |
| Redirect URIs           | URL(s) where Pleo sends users after authentication. Must be HTTPS in production.                                     |
| Scopes                  | API permissions your OAuth 2.0 client needs to access on behalf of the integration.                                  |
| PKCE Support            | Required for public clients to prevent authorisation-code attacks. Contact your Pleo Partner Manager for exceptions. |
| Subject Type Preference | (Optional) Default resource type your OAuth 2.0 client operates on when calling Pleo APIs.                           |

<RememberCallout title="Remember">
  For local development, loopback redirect URIs (`localhost`, `127.0.0.1`, `[::1]`) may use HTTP.
</RememberCallout>

<RememberCallout title="Remember">
  Each Pleo API defines its own set of [scopes](/docs/current/authentication/api-scopes). Your registered OAuth 2.0 client can only access APIs and perform actions that correspond to the scopes you request during registration.
</RememberCallout>

#### Example Registration

| Parameter               | Value                                                                                |
| ----------------------- | ------------------------------------------------------------------------------------ |
| Client Name             | Example Client                                                                       |
| Client URI              | [https://client.example/](https://client.example/)                                   |
| Terms of Service        | [https://client.example/legal/tos.html](https://client.example/legal/tos.html)       |
| Privacy Policy          | [https://client.example/legal/privacy.pdf](https://client.example/legal/privacy.pdf) |
| Contacts                | [name.surname@example.io](mailto:name.surname@example.io)                            |
| Redirect URIs           | [https://client.example/callback](https://client.example/callback)                   |
| Scopes                  | users:read users:write                                                               |
| PKCE Support            | Supported                                                                            |
| Subject Type Preference | None                                                                                 |

<RememberCallout title="Remember">
  Verify all URLs and scopes before submitting. Incorrect redirect URIs or missing scopes commonly cause authorisation failures.
</RememberCallout>

***

### 2. Receive Client Credentials

<WarningCallout title="Warning">
  Do **not** embed the Client Secret in frontend code or distribute it. Storing secrets on client devices is not supported by Pleo.
</WarningCallout>

After registration, Pleo shares your credentials securely via 1Password:

| Credential    | Description                                                                                                            | Example Value                        |
| ------------- | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------ |
| Client ID     | Public identifier used to request authorisation and identify your app.                                                 | 12a3b456-78c9-0d12-34e5-f678ab9bcd0e |
| Client Secret | Confidential secret used to authenticate your app. Must be stored securely on a server and never exposed to end users. | 12345a6bcd789ef012abcd34ef5a6b       |

## Result

After completing these steps:

* Your OAuth 2.0 client is registered in Pleo’s Staging environment.
* You have received a **Client ID** and **Client Secret**.
* No users are authorised.
* No access tokens exist.
* API calls are **not possible** at this stage.

## What Comes Next?

<WhatComesNext href="/docs/current/how-tos/oauth/how-to-direct-users-to-the-authorisation-endpoint">
  Redirect users to the authorisation endpoint
</WhatComesNext>

***

<div className="text-xs uppercase" style={{ fontVariant: 'small-caps' }}>
  this how-to is part of:
</div>

<div className="mt-4 flex flex-wrap gap-2">
  <a
    href="/docs/current/guides/oauth-workflow-guide"
    className="inline-flex items-center rounded-full border border-gray-300 dark:border-gray-600 
px-3 py-1 text-xs font-medium 
bg-white dark:bg-[#1f262b] text-black dark:text-white
hover:bg-gray-100 dark:hover:bg-[#2b2f33]
transition-colors"
  >
    OAuth 2.0 Setup Workflow Guide (Manual Token Lifecycle)
  </a>
</div>

***

## FAQs

<Accordion title="What is the difference between an integration, application, and OAuth 2.0 client?">
  These terms describe different parts of how OAuth 2.0 works in the Pleo platform.

  The difference between an **integration**, **application**, and **OAuth 2.0 client** is explained in the [OAuth 2.0 Concepts and Terminology](/docs/current/authentication/oauth/oauth-overview#concepts-and-terminology) section.
</Accordion>

***

## Related Reading

* [OAuth 2.0 Client Registration](/docs/current/integration-design/auth/oauth/getting-set-up/oauth-client-registration) – Step-by-step details of required fields, credentials, and redirect URIs.
* [OAuth 2.0 Client Configuration](/docs/current/integration-design/auth/oauth/getting-set-up/oauth-client-configuration) – How to configure your client with correct endpoints, PKCE, and authentication methods.
* [PKCE and Secured Patterns](/docs/current/integration-design/auth/oauth/implementing-oauth/integration-design-auth-oauth-pkce-and-secured-patterns) – Security requirements for public clients.

***