Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What are the client ID and client secret?
Short answer
The client ID and client secret are the information belonging to an application's registration at an OAuth 2.0 / OpenID Connect provider (RFC 6749). The client ID is the public identity of the application and appears in authorization requests; the client secret, on the other hand, is the secret value with which the application proves itself at the token endpoint, and it is kept only on the server side. Both are generated when the application registration is created at the provider (e.g., Google Cloud Console, Microsoft Entra ID). In TR7 AGS, in the OAuth2 and OpenID Connect types, these values are entered in the Client ID (required) and Client Secret fields; the secret is written in a masked field and is shown masked in the preview. In Custom Provider, the Client Authentication field selects whether the secret is sent to the token endpoint in the request body (client_secret_post, default) or in the HTTP Basic header (client_secret_basic); for public clients registered without a secret, "Public client — no client secret sent" is selected and Client Secret is left empty.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Providers (OAuth2, OpenID Connect) | Client ID, Client Secret | The identity and secret of the application registration at the provider |
| Same form (Custom Provider) | Client Authentication: client_secret_post (default), client_secret_basic, Public client | How the secret is sent to the token endpoint |
| Same form (Custom Provider) | User Info Parameters; {clientId}, {clientSecret} placeholders | Additional parameters that the provider requires in the user info request |
| Same form | Redirect URI | The return address written in the application registration at the provider together with the Client ID |
Common Misconceptions
- "The client ID must be kept secret." The Client ID is public and appears in the authorization address that the browser goes to; what must be kept secret is the client secret.
- "The client secret is the user's password." The secret belongs to the application, that is, to the provider profile in TR7; it has nothing to do with the users' passwords.
- "When the secret is changed, TR7 updates it by itself." When the secret is renewed at the provider or expires, the new value is entered in the Client Secret field in TR7; otherwise no token can be obtained and login fails.
How it is done in the documentation
