create_oauth_client
Create an organization-bound OAuth API client for Skilljar to enable authenticated access to courses and learners. Configure scopes and IP allowlist, then receive a one-time secret credential.
Instructions
Create an API client BOUND TO THIS ORGANIZATION. Returns a one-time secret.
THIS IS NOT `register_oauth_client`, and the difference decides whether the
credential works:
create_oauth_client authenticated, and BOUND TO YOUR ORGANIZATION. The
(this tool) resulting client can read your courses and learners,
within the scopes you give it.
register_oauth_client unauthenticated RFC 7591 dynamic registration. Skilljar
binds NO organization to it. The client authenticates
fine and then reads nothing, forever, with no error
that says why.
Use this one unless you specifically need dynamic registration.
Scope it with EITHER `scope_codenames` (exact, from `list_oauth_scopes`) OR
`scope_preset` (a named bundle). Not both — they are two ways of saying the same
thing and sending both is ambiguous. Give the smallest set that works: scopes are
the only control that survives a leaked secret.
`ip_allowlist` restricts where the client may be used from. Empty means anywhere.
THE RETURNED SECRET IS SHOWN ONCE. There is no endpoint that reads it back; if it
is lost the client must be rotated or replaced.
Requires the `clients:write` OAuth scope, and the `admin` capability profile.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| description | No | ||
| ip_allowlist | No | ||
| scope_preset | No | ||
| scope_codenames | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| name | No | ||
| warning | No | ||
| client_id | No | ||
| is_active | No | ||
| created_at | No | ||
| description | No | ||
| ip_allowlist | No | ||
| client_secret | No | ||
| scope_codenames | No |