How to use OAuth 2.0 for native and mobile apps

Public clients such as native and mobile apps cannot maintain the confidentiality of a client secret. When using OAuth 2.0 for native and mobile apps, we generate an app ID, and use the Public Key for Code Exchange (PKCE) to provide additional verification.

• You have the required permissions for adding and managing OAuth apps in this Organization. See What Organization roles are available in Tanzu Platform cloud services.

PKCE is a technique to secure public clients that don’t use a client secret. See this blog for more information about using PKCE with mobile apps.

1. Click your user name and select View Organization > OAuth Apps, and then click Create New OAuth App.

2. Select Native/Mobile app and click Continue.

3. Register your app by entering the app details:

   1. Type a name and description for the new Oauth app.

   2. Enter at least one redirect URI.

      After a user authorizes your client, the authorization server redirects the user back to your client to the URI you specified with an access token. It is best practice to add more than one URI. Use the format http://acme.com.

   3. Specify a time span for your access token.

      The default Access Token time to live (TTL) setting is 30 minutes. The maximum value you can set is 300 minutes (five hours). The minimum value you can set is 1 minute.

   4. If you want your access token to authorize requests continuously, select the Issue a refresh token and set Refresh Token TTL value.

      The default Refresh Token TTL is 30 minutes. The maximum value you can set is 300 minutes (five hours). The minimum value you can set is 1 minute.

4. Define scopes.

   Scopes provide a way to implement control over what areas in your Organization your client can access - specifically which of your services and the level of permission.

5. Select the Open ID check box to get information about the users that authorize your app.

6. Click Create to generate the client credentials.

7. Copy the app ID or download a JSON file that contains the app ID. You are responsible for storing these credentials in a safe place.

8. Click Continue.

Paste the credentials into your script.

Parent topic:How do I create OAuth 2.0 apps and authenticate applications