> ## Documentation Index > Fetch the complete documentation index at: https://docs.member.dev/llms.txt > Use this file to discover all available pages before exploring further. # Create Oauth Client > Register a new OAuth client for a team hub. Returns the plaintext `client_secret` in `data.attributes.client_secret` for confidential clients — this is the ONLY time it is returned; store it immediately. Public (PKCE-only) clients receive `client_secret: null`. Managing OAuth clients requires a real user (JWT) session — an API key cannot register OAuth clients (potential persistence attack). ## OpenAPI ````yaml /openapi/mio-openapi.json post /api/v1/teams/{team_id}/oauth-clients openapi: 3.1.0 info: description: >- Production API reference for Membership.io. Use the authored guides for workflows and the generated endpoint pages for exact parameters and schemas. title: Membership.io API version: 0.1.0 servers: - description: Production url: https://api.member.dev security: - bearerAuth: [] paths: /api/v1/teams/{team_id}/oauth-clients: post: tags: - oauth-clients summary: Create Oauth Client description: >- Register a new OAuth client for a team hub. Returns the plaintext `client_secret` in `data.attributes.client_secret` for confidential clients — this is the ONLY time it is returned; store it immediately. Public (PKCE-only) clients receive `client_secret: null`. Managing OAuth clients requires a real user (JWT) session — an API key cannot register OAuth clients (potential persistence attack). operationId: oauth_clients.post_oauth_clients_post_teams_by_team_id_oauth_clients parameters: - in: path name: team_id required: true schema: title: Team Id type: string requestBody: content: application/vnd.api+json: schema: $ref: '#/components/schemas/OAuthClientCreateRequest' required: true responses: '201': content: application/vnd.api+json: schema: $ref: >- #/components/schemas/JsonApiResponse_OAuthClientCreateAttributes_ description: Successful Response '422': content: application/vnd.api+json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Validation Error security: - HTTPBearer: [] components: schemas: OAuthClientCreateRequest: additionalProperties: false description: >- Request body for registering a new OAuth client. Accepts EITHER a flat body OR a full JSON:API envelope. NOTE: first_party and allowed_scopes are deliberately absent — only platform-admins can set those via PlatformOAuthClientUpdateRequest. `extra="forbid"` makes the team-owner endpoint REJECT unknown fields (e.g. a smuggled `first_party`/`allowed_scopes`) with 422 rather than silently ignoring them. The before-validator strips the JSON:API envelope so `data`/`type` wrapper keys never reach this forbid check. properties: brand_label: anyOf: - type: string - type: 'null' title: Brand Label is_public: default: false title: Is Public type: boolean logo_url: anyOf: - type: string - type: 'null' title: Logo Url name: title: Name type: string redirect_uris: default: [] items: type: string title: Redirect Uris type: array required: - name title: OAuthClientCreateRequest type: object JsonApiResponse_OAuthClientCreateAttributes_: properties: data: $ref: '#/components/schemas/JsonApiResource_OAuthClientCreateAttributes_' included: anyOf: - items: {} type: array - type: 'null' title: Included links: anyOf: - $ref: '#/components/schemas/JsonApiLinks' - type: 'null' meta: anyOf: - additionalProperties: true type: object - type: 'null' title: Meta required: - data title: JsonApiResponse[OAuthClientCreateAttributes] type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object JsonApiResource_OAuthClientCreateAttributes_: properties: attributes: $ref: '#/components/schemas/OAuthClientCreateAttributes' id: title: Id type: string links: anyOf: - $ref: '#/components/schemas/JsonApiLinks' - type: 'null' meta: anyOf: - additionalProperties: true type: object - type: 'null' title: Meta relationships: anyOf: - additionalProperties: true type: object - type: 'null' title: Relationships type: title: Type type: string required: - id - type - attributes title: JsonApiResource[OAuthClientCreateAttributes] type: object JsonApiLinks: properties: self: anyOf: - type: string - type: 'null' title: Self title: JsonApiLinks type: object ValidationError: properties: ctx: title: Context type: object input: title: Input loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object OAuthClientCreateAttributes: description: |- Attributes returned ONLY on the 201 create response. Includes `client_secret` — the full plaintext secret, returned once and never again. None for public (PKCE-only) clients. properties: allowed_scopes: items: type: string title: Allowed Scopes type: array brand_label: anyOf: - type: string - type: 'null' title: Brand Label client_id: title: Client Id type: string client_secret: anyOf: - type: string - type: 'null' title: Client Secret created_at: anyOf: - format: date-time type: string - type: 'null' title: Created At first_party: title: First Party type: boolean hub_id: title: Hub Id type: string is_public: title: Is Public type: boolean logo_url: anyOf: - type: string - type: 'null' title: Logo Url name: title: Name type: string team_id: title: Team Id type: string updated_at: anyOf: - format: date-time type: string - type: 'null' title: Updated At required: - client_id - name - is_public - first_party - allowed_scopes - hub_id - team_id title: OAuthClientCreateAttributes type: object securitySchemes: bearerAuth: bearerFormat: JWT or mio_sk API key description: >- Send platform JWTs, contact JWTs, or team API keys as `Authorization: Bearer `. scheme: bearer type: http HTTPBearer: scheme: bearer type: http ````