Request a client
The Done team creates each client. You send a request with the information below, and we send you the client ID. If your client type uses a secret, we send the secret through a secure channel.
Information to send
Send one request for each app and each environment:
| Field | Example | Notes |
|---|---|---|
| App name | Acme Spend | The name that users see. |
| Company and contact | Acme AB, dev@acme.example | The person who receives the credentials. |
| Environment | Sandbox | Sandbox or production. |
| Integration type | Browser or mobile login | See Integration types. |
| Redirect URIs | https://spend.acme.example/callback | Login types only. Done ID sends the user back only to these addresses. |
| Post-logout redirect URIs | https://spend.acme.example/ | Login types only. Done ID sends the user here after logout. |
| Web origins | https://spend.acme.example | Browser login only. The origins that call the token endpoint from the browser (CORS). |
| Done OS APIs | Partner API | The APIs that your app calls with the token. |
| Registration redirect URLs | https://spend.acme.example/onboarding/* | Optional. Only if you create registration sessions. The URLs where Done OS may send a user after the email verification. See Redirect URLs. |
Give the exact redirect URIs. Done ID compares them with the URI in each login request. A wildcard at the end of the path (https://spend.acme.example/*) is possible, but an exact URI is safer.
For a mobile app, give the redirect URI that the app registers with the operating system. Use a claimed HTTPS link (Universal Link on iOS, App Link on Android) or a custom scheme that you own, for example com.acme.spend:/callback.
What you receive
| Integration type | You receive |
|---|---|
| Machine to machine | Client ID and client secret |
| Server-side login | Client ID and client secret |
| Browser or mobile login | Client ID |
Keep the secret safe
If you receive a client secret, keep it on your server only:
- Store the secret in a secret store or in an environment variable on the server.
- Do not put the secret in a browser app, a mobile app, or a source repository.
- If the secret leaks, contact the Done team. We issue a new secret and stop the old one.
When you contact the Done team about a client, give the client ID. Never send the client secret.