OAuth2 credentials

How to obtain your Lemonade's OAuth2 client credentials

We provide two ways to obtain your Lemonade's OAuth2 client credentials:

• using our UI (coming soon)

• using our GraphQL API endpoints

  • staging API: https://staging.backend.lemonade.social

  • production API: https://backend.lemonade.social

Using GraphQL API endpoints to obtain OAuth2 credentials

The following endpoints require user authentication. Please include your session token in x-ory-kratos-session header of the request. You can find this token by inspecting the cookie of your network requests to Lemonade backend API.

• for staging environment, the name of the cookie is: ory_kratos_session_staging

• for production environment, the name of the cookie is: ory_kratos_session

To create OAuth2 credentials

mutation($input: Oauth2ClientInput!) {
  createOauth2Client(input: $input) {
    client_id
    client_secret
  }
}

Important note: Please include the client_secret field in the response and take note of it because this is the only time we display it to you. Further requests to retrieve the client info will not return this value.

To retrieve OAuth2 credentials

query($ids: [String!]) {
  listOauth2Clients(ids: $ids) {
    client_id
  }
}

If you want to retrieve a specified OAuth2 client, supply its id in the optional ids params. Omit this param to obtain all the OAuth2 clients that are belong to you.

To update OAuth2 credentials

mutation($input: Oauth2ClientInput!, $updateOauth2ClientId: String!) {
  updateOauth2Client(input: $input, id: $updateOauth2ClientId) {
    client_id
    client_name
  }
}

For possible update fields, please refer to our GraphQL API introspection playground.

To remove OAuth2 credentials

mutation($deleteOauth2ClientId: String!) {
  deleteOauth2Client(id: $deleteOauth2ClientId)
}

OAuth2 client default settings

The following properties are prefilled with any OAuth2 clients and cannot be updated:

• grant_types: ['authorization_code', 'refresh_token', 'client_credentials']

• scope: 'offline_access offline openid audience'

• audience: [id of the user who request the client creation]

• token_endpoint_auth_method: 'client_secret_post'