Client ID and secret

What you get

Apps without a server (SPA or mobile) only get a Client ID. They cannot keep a secret, so they rely on PKCE instead.

How to ask for keys

Teams with developer access create their own apps in the Developer Console, without waiting for an admin.

1. No developer access yet? Email support@society-ai.org with the name of the service you're building. Once access is granted, the Console opens straight away.
2. Open the Developer Console and create a project for your service. Invite teammates from the Team tab.
3. Click New testing app. The Client ID and secret show up once in the Save this secret now box, and Copy .env prepares your .env.
4. Once sign-in works with a tester account, open the app and click Ask for a production version. An owner or admin reviews it, and you get an email once it is decided.
5. Once approved, click Create production key within 14 days. The production secret is shown only to you. Admins never see it.

Need an admin's help, or can't use the Console yet? Copy the template below and send it to the same address.

To: support@society-ai.org
Subject: Society AI sign-in app request - <service name>

Service name (shown on the sign-in page): Kelas Society AI
Service address: https://kelas.society-ai.org
Owner: <name>, <email>
App type: Has a server / No server (SPA or mobile)

Callback URLs, up to 5:
- https://kelas.society-ai.org/auth/callback

Back-channel logout URL:
- https://kelas.society-ai.org/auth/backchannel-logout

Member data needed (strike what you don't need):
- Name and language (profile)
- Email (email)
- Membership status (membership)
- Stay signed in past 15 minutes without the member present (offline_access)

Testing version as well? Yes
- Testing callback URL: http://127.0.0.1:8000/auth/callback
- Tester emails (up to 20): <email1>, <email2>

Two kinds of app

The kind cannot be changed after the app is created. To go live, click Ask for a production version on the testing app. You get a new production app with its own Client ID.

Callback URL rules

• It must match what your app sends exactly, including https, the port, and any trailing slash.
• It must be on a society-ai.org subdomain or an approved domain, for example https://kelas.society-ai.org/auth/callback.
• Up to 5 URLs per app.
• No #, *, spaces, or user names in the URL.
• localhost and 127.0.0.1 are for testing apps only, and must include a port.

Services on other domains, like pandawan.id, are registered first under Project → Domains in the Console. Once an owner or admin approves it, that domain and all its subdomains can be used, still over https.

Member data you can ask for

Only ask for what you use. Every claim is described in the API reference.

For admins: where the keys show up

Teams with developer access manage their own apps in the Console. Admins grant developer access under Admin → Users, review production versions and domains under Admin → Requests, and revoke domains under Admin → Domains. For teams not using the Console yet, apps can still be created from the panel:

1. Open Admin → Aplikasi Terhubung → Tambah aplikasi.
2. Fill it in from the request email: kind (testing or production), name, callback URLs, back-channel URL, shared data, and testers.
3. After saving, a box titled "Simpan secret ini untuk developer" shows the Client ID and Client secret, each with a copy button.
4. The secret is shown in that box once. After the page closes nobody can see it again, admins included.

Send the secret straight to the person responsible for the app, for example in a private message they can delete after reading. Not in a group, an issue, or a shared document.

Replacing a secret

Changing the name, callback URLs, shared data, or testers keeps the same Client ID and secret. Change them on the app's page in the Console. For production apps, Duplicate and New secret ask for a new sign-in code if you last signed in more than 15 minutes ago.