Register an App

Before your application can sign users in through vuer-auth, it must be registered as an OAuth client. This page explains what a client is, what you need, and how to create one.

Good news: there is no client secret / app key. vuer-auth apps are public clients that use PKCE, so you only manage a clientId and a list of allowed redirect URLs.

What a client is

A client (an "app") is one entry in vuer-auth that represents your application. It has just three things you care about:

Field	Description
`clientId`	An identifier you choose, e.g. `dreamlake-app`. Allowed characters: letters, numbers, `-`, `_` (max 100). It becomes the `aud` (audience) claim of every token issued to your app.
`name`	A display name shown on the sign-in / consent screen.
`redirectURLs`	The list of callback URLs your app is allowed to be redirected back to after login. The login flow rejects any `redirect_uri` that is not in this list.

Note: Register the redirect URLs for every environment your app runs in — e.g. http://localhost:5173/auth/callback for local development, https://yourapp.com/auth/callback for production.

Do you need a client for your flow?

Login flow	Needs a registered client?
Browser SPA (OAuth2 + PKCE)	Yes — `clientId` plus matching `redirectURLs`.
Device flow (RFC 8628)	Pass your `clientId` (defaults to `"default"`). Register it so the token `aud` is meaningful.
CLI local-server (sign-in server)	No per-client registration — it forwards the signed-in user's token.

Who can register

App registration is admin-only. The signed-in user's email must be present in the vuer-auth server's ADMIN_EMAILS configuration. If you do not operate the vuer-auth server yourself, ask the maintainers to register your clientId and redirect URLs.

How to register

Option 1 — Application Management UI

Sign in to vuer-auth with an admin account.
Open Application Management at /app-config.
Create a new app and fill in Name, Client ID, and Redirect URLs (comma-separated).

Option 2 — API

Send an authenticated (admin session) request:

curl -X POST https://staging-auth.vuer.ai/api/clients \
  -H "Content-Type: application/json" \
  --cookie "<your admin session cookie>" \
  -d '{
    "name": "Dreamlake App",
    "clientId": "dreamlake-app",
    "redirectURLs": ["https://dreamlake.ai/auth/callback", "http://localhost:5173/auth/callback"]
  }'

A successful call returns 201 with the created application.

Other client-management endpoints (all admin-only):

Method & path	Purpose
`GET /api/clients?page=1&pageSize=10`	List registered apps
`POST /api/clients`	Create an app
`PUT /api/clients/:id`	Update an app's name / redirect URLs
`DELETE /api/clients/:id`	Delete an app

Option 3 — Registration script

Maintainers can register an app directly against the database with a script (see scripts/register-*-app.ts in the vuer-auth repo). These create a type: public client with no secret.

Using your client

Once registered, plug the clientId into your integration:

import { createAuthClient } from "@vuer-ai/vuer-auth-client";

export const authClient = createAuthClient({
  baseURL: "https://staging-auth.vuer.ai", // or https://auth.vuer.ai
  clientId: "dreamlake-app",               // your registered clientId
  redirectUri: "/auth/callback",           // must be one of your registered redirectURLs
});