> For the complete documentation index, see [llms.txt](https://lemonade.gitbook.io/welcome-to-lemonade/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lemonade.gitbook.io/welcome-to-lemonade/auth2.0/oauth2-credentials.md).

# OAuth2 credentials

How to obtain your Lemonade's OAuth2 client credentials

We provide two ways to obtain your Lemonade's OAuth2 client credentials:

* using our UI (coming soon)
* using our GraphQL API endpoints
  * staging API: <https://staging.backend.lemonade.social>
  * production API: <https://backend.lemonade.social>

## Using GraphQL API endpoints to obtain OAuth2 credentials

The following endpoints require user authentication. Please include your session token in `x-ory-kratos-session` header of the request. You can find this token by inspecting the cookie of your network requests to Lemonade backend API.

* for staging environment, the name of the cookie is: `ory_kratos_session_staging`
* for production environment, the name of the cookie is: `ory_kratos_session`

### To create OAuth2 credentials

```graphql
mutation($input: Oauth2ClientInput!) {
  createOauth2Client(input: $input) {
    client_id
    client_secret
  }
}
```

<mark style="color:red;">**Important note:**</mark> Please include the `client_secret` field in the response and take note of it because **this is the only time we display it to you**. Further requests to retrieve the client info will not return this value.

### To retrieve OAuth2 credentials

```graphql
query($ids: [String!]) {
  listOauth2Clients(ids: $ids) {
    client_id
  }
}
```

If you want to retrieve a specified OAuth2 client, supply its id in the optional `ids` params. Omit this param to obtain all the OAuth2 clients that are belong to you.

### To update OAuth2 credentials

```graphql
mutation($input: Oauth2ClientInput!, $updateOauth2ClientId: String!) {
  updateOauth2Client(input: $input, id: $updateOauth2ClientId) {
    client_id
    client_name
  }
}
```

For possible update fields, please refer to our GraphQL API introspection playground.

### To remove OAuth2 credentials

```graphql
mutation($deleteOauth2ClientId: String!) {
  deleteOauth2Client(id: $deleteOauth2ClientId)
}
```

## OAuth2 client default settings

The following properties are prefilled with any OAuth2 clients and cannot be updated:

* grant\_types:\
  &#x20;`['authorization_code', 'refresh_token', 'client_credentials']`
* scope:\
  `'offline_access offline openid audience'`
* audience:\
  `[id of the user who request the client creation]`
* token\_endpoint\_auth\_method:\
  `'client_secret_post'`