Client Register

Register a pending OAuth client; confidential web needs a secret or private key method and a valid redirect, public native needs method none, DPoP and a valid redirect, and service needs a service account, a supported authentication method and no redirect. Web redirects require HTTPS except localhost HTTP; native redirects allow loopback HTTP(S) or a custom scheme. Initial secret is generated for client_secret_basic if omitted and rejected for other methods. The plaintext secret is returned once. Register the widget as confidential_web with assistant.widget in scopes under its own non-sellable Assistant product. This reserved scope enables host-bound widget authorization; do not grant it to ordinary product clients. GET /authorize requires host_product_id (host product UUID) and assistant.widget in the requested scopes for this client. The host must register an active assistant.chat feature. host_product_id is persisted in authorization_request.requested_audience; issued access-token audience remains the Assistant product. The code transaction binds one current host product_login generation in the same SSO. Missing host admission returns login_required for prompt=none; interactive use must first sign in to the host. Callback URIs are exact environment configuration, locally https://assistant.local.globalbes.sg/widget/callback. No Assistant membership or entitlement is required; no iframe permission is added.

POST /internal/control/v1/clients