> ## Documentation Index
> Fetch the complete documentation index at: https://developers.pleo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth 2.0 Client Configuration

export const RememberCallout = ({title, children}) => <div className="callout-box callout-remember">
    <div className="callout-row">
      <span className="callout-icon">
        <svg width="22" height="22" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="currentColor"><path d="M229.66,98.34,172.39,155.8c11.46,22.93-1.72,45.86-10.11,57a8,8,0,0,1-12,.83L42.34,105.76A8,8,0,0,1,43,93.85c29.65-23.92,57.4-10,57.4-10l57.27-57.46a8,8,0,0,1,11.31,0L229.66,87A8,8,0,0,1,229.66,98.34Z" opacity="0.2" /><path d="M235.32,81.37,174.63,20.69a16,16,0,0,0-22.63,0L98.37,74.49c-10.66-3.34-35-7.37-60.4,13.14a16,16,0,0,0-1.29,23.78L85,159.71,42.34,202.34a8,8,0,0,0,11.32,11.32L96.29,171l48.29,48.29A16,16,0,0,0,155.9,224c.38,0,.75,0,1.13,0a15.93,15.93,0,0,0,11.64-6.33c19.64-26.1,17.75-47.32,13.19-60L235.33,104A16,16,0,0,0,235.32,81.37ZM224,92.69h0l-57.27,57.46a8,8,0,0,0-1.49,9.22c9.46,18.93-1.8,38.59-9.34,48.62L48,100.08c12.08-9.74,23.64-12.31,32.48-12.31A40.13,40.13,0,0,1,96.81,91a8,8,0,0,0,9.25-1.51L163.32,32,224,92.68Z" /></svg>
      </span>
      <div>
        {title && <div className="callout-title">
            {title}
          </div>}
        <div className="callout-body">
          {children}
        </div>
      </div>
    </div>
  </div>;

Once your OAuth 2.0 client is registered with Pleo and you have received your **Client ID** and **Client Secret**, you must configure your **OAuth 2.0 client** to communicate with Pleo’s Authorisation Server.

OAuth 2.0 client [registration establishes](/docs/current/integration-design/auth/oauth/getting-set-up/oauth-client-registration) your **OAuth 2.0 client’s identity** with Pleo.

OAuth 2.0 client configuration enables your integration to perform the OAuth 2.0 protocol, including:

* Redirecting users to Pleo for authorisation
* Receiving authorisation codes
* Exchanging codes for access and refresh tokens
* Refreshing tokens securely
* Calling Pleo APIs on behalf of authorised users

This configuration is completed within your **OAuth 2.0 client** using your chosen OAuth 2.0 library or framework.

## When You Need This

You should complete OAuth 2.0 client configuration after:

* Registering your OAuth 2.0 client with Pleo
* Receiving your **Client ID** and **Client Secret**
* Selecting an OAuth 2.0 client library or framework

This page describes **what must be configured**, not how to implement it in a specific programming language.

## Configuration Checklist

Ensure your **OAuth 2.0 client** is configured with:

* Client ID
* Authorisation endpoint
* Token endpoint
* Redirect URI (must match registered values exactly)
* Requested scopes
* PKCE enabled (S256)

## Required OAuth 2.0 Configuration Parameters

Configure your OAuth 2.0 client using the following values:

| Parameter              | Value                                        |
| ---------------------- | -------------------------------------------- |
| Authorisation Endpoint | `{AUTHORIZATION_SERVER_URL}/oauth/authorize` |
| Token Endpoint         | `{AUTHORIZATION_SERVER_URL}/oauth/token`     |
| Grant Type             | Authorisation Code (with PKCE)               |
| PKCE                   | Required (S256 only)                         |
| Redirect URI           | One of the registered redirect URIs          |
| Scopes                 | Approved scopes from client registration     |

<RememberCallout title="Remember">
  Exact configuration keys depend on the OAuth 2.0 library you use. Refer to your library’s documentation for precise mappings.
</RememberCallout>

## PKCE Requirements

Pleo requires [**Proof Key for Code Exchange (PKCE)**](/docs/current/integration-design/auth/oauth/implementing-oauth/integration-design-auth-oauth-pkce-and-secured-patterns) where supported by the client.

* Only the **S256** code challenge method is supported
* Plain (`plain`) PKCE is not allowed
* PKCE is **mandatory for public clients** (SPAs, mobile apps)
* PKCE is **strongly recommended for confidential clients**

Ensure your OAuth 2.0 library is configured to:

* Generate a `code_verifier`
* Send the corresponding `code_challenge` during authorisation
* Provide the `code_verifier` during token exchange

## Authorisation Server URLs

Replace `{AUTHORIZATION_SERVER_URL}` with the base URL of the environment you are targeting:

| Environment | Authorisation Server URL       |
| ----------- | ------------------------------ |
| Staging     | `https://auth.staging.pleo.io` |
| Production  | `https://auth.pleo.io`         |

Always test your integration fully in **staging** before switching to production.

## Redirect URI Configuration

Your OAuth 2.0 client must use redirect URIs that:

* Exactly match the URIs registered with Pleo
* Are publicly accessible (except `localhost` for development)
* Use HTTPS in production environments
* Do not contain wildcards

If your integration supports multiple post-login destinations, use the OAuth 2.0 `state` parameter to route users internally **after** authorisation.

## Client Authentication Method

Pleo supports **client authentication at the token endpoint only for confidential clients**.

* Supported method: `client_secret_basic`

Confidential clients must:

* Send the Client ID and Client Secret via HTTP Basic Authentication
* Store the Client Secret securely on the server
* Never expose the Client Secret in frontend or public code

Public clients (SPAs, mobile apps):

* **Must not use a client secret**
* Must rely on PKCE for security

## What This Configuration Enables

Once configured correctly, your OAuth 2.0 client can:

* Redirect users to Pleo for authorisation
* Receive authorisation codes securely
* Exchange codes for access and refresh tokens
* Refresh access tokens without re-prompting users
* Access Pleo APIs on behalf of authorised users

## FAQs

<Accordion title="What is the difference between an integration, application, and OAuth 2.0 client?">
  These terms describe different parts of how OAuth 2.0 works in the Pleo platform.

  The difference between an **integration**, **application**, and **OAuth 2.0 client** is explained in the [OAuth 2.0 Concepts and Terminology](/docs/current/authentication/oauth/oauth-overview#concepts-and-terminology) section.
</Accordion>

## Related Reading

* [OAuth 2.0 Libraries and Standards](/docs/current/integration-design/auth/oauth/implementing-oauth/integration-design-auth-oauth-libraries-and-standards)
* [Token Lifecycle](/docs/current/integration-design/auth/oauth/token-lifecycle/integration-design-auth-oauth-token-overview)
* [OAuth 2.0 Setup Workflow Guide](/docs/current/guides/oauth-workflow-guide)