Everything in this page happens in your 36Blocks dashboard, inside your block's settings. Nothing here requires writing any code yet.

1. Open your block.

2. Go to the OAuth section.

3. Click Add OAuth.

4. Fill in the form:

   Field	Notes
   Name	Shown to your users on the consent screen as the name of the app requesting access.
   Client type	Confidential or Public. See Overview if you're unsure which fits. This cannot be changed after the config is created; if you pick wrong, delete and recreate it.
   Require PKCE	A toggle. Always on and locked for public clients (PKCE is mandatory for them). Optional for confidential clients; turn it on if you want an extra layer of protection even though the client can hold a secret.
   Allowed scopes	Pick every scope this integration is allowed to request: profile, email, and/or any custom scopes your block has defined. You can create a new custom scope right from this dropdown via its Create scope button, without leaving the dialog. A connecting app can never request a scope outside this list; it'll be rejected if it tries.
   Redirect URIs	Type a redirect URI and press Enter (or separate with commas) to add it as a chip; add as many as you need. The third-party app must send back exactly one of these (character-for-character) on every request; there's no partial or wildcard matching.

5. Click Add OAuth.

6. A dialog shows your new Client ID and, for confidential clients only, a Client secret. Copy the secret now: it is shown exactly once and cannot be retrieved again. If you lose it, use Regenerate secret from the config's menu. This immediately invalidates the old secret, with no overlap period, so coordinate with whoever's using it on the other end before you regenerate.

Public clients don't get a secret at all. They authenticate using PKCE instead (see Consent screen).

From the ⋮ menu on any row in the OAuth list you can:

• Edit: change the name, PKCE requirement, allowed scopes, or redirect URIs. Client type can't be edited here either.

• Regenerate secret (confidential clients only).

• Disable / Enable: disabling immediately revokes every active connection made through this config (any app that had already connected loses access right away, and has to go through consent again once you re-enable it). Enabling just allows new connections again; it does not restore anything that was revoked while disabled.

• Delete: removes the config from your list. It does not revoke existing connections by itself; disable it first if you also want to cut off access that's already been granted.

Only needed if profile/email aren't enough and you want to gate your own, product-specific data behind OAuth.

1. Open your block.

2. Go to the Scope section (next to OAuth).

3. Click Add Scope.

4. Fill in the form:

   Field	Notes
   Key	The opaque string a connecting app will request (e.g. tickets:read) and that will show up in the token's granted-scopes list. Lowercase letters, numbers, and underscores only, with optional colon-separated segments. This is purely a string as far as 36Blocks is concerned; we don't enforce any meaning behind it, your own backend decides what having this scope actually permits. (Compare to profile/email, which are built in and already understood by our own Me endpoint.) The key can't be changed after creation; delete and recreate if you need a different one.
   Label	The human-readable sentence shown on the consent screen, e.g. "Read your tickets." Can be edited any time.

5. Click Add Scope.

A custom scope is defined once per block, not per OAuth Config. Once created, it's available to pick from the Allowed scopes list on any OAuth Config belonging to that same block.