# Request a client
The Done team creates each client. You send a request with the information below, and we send you the client ID. If your client type uses a secret, we send the secret through a secure channel.

## Information to send

Send one request for each app and each environment:

| Field | Example | Notes |
|---|---|---|
| App name | Acme Spend | The name that users see. |
| Company and contact | Acme AB, dev@acme.example | The person who receives the credentials. |
| Environment | Sandbox | Sandbox or production. |
| Integration type | Browser or mobile login | See [Integration types](/#integration-types). |
| Redirect URIs | `https://spend.acme.example/callback` | Login types only. Done ID sends the user back only to these addresses. |
| Post-logout redirect URIs | `https://spend.acme.example/` | Login types only. Done ID sends the user here after logout. |
| Web origins | `https://spend.acme.example` | Browser login only. The origins that call the token endpoint from the browser (CORS). |
| Done OS APIs | Partner API | The APIs that your app calls with the token. |
| Registration redirect URLs | `https://spend.acme.example/onboarding/*` | Optional. Only if you create registration sessions. The URLs where Done OS may send a user after the email verification. See [Redirect URLs](/user-accounts#redirect-urls). |

Give the exact redirect URIs. Done ID compares them with the URI in each login request. A wildcard at the end of the path (`https://spend.acme.example/*`) is possible, but an exact URI is safer.

For a mobile app, give the redirect URI that the app registers with the operating system. Use a claimed HTTPS link (Universal Link on iOS, App Link on Android) or a custom scheme that you own, for example `com.acme.spend:/callback`.

## What you receive

| Integration type | You receive |
|---|---|
| Machine to machine | Client ID and client secret |
| Server-side login | Client ID and client secret |
| Browser or mobile login | Client ID |

## Keep the secret safe

If you receive a client secret, keep it on your server only:

1. Store the secret in a secret store or in an environment variable on the server.
2. Do not put the secret in a browser app, a mobile app, or a source repository.
3. If the secret leaks, contact the Done team. We issue a new secret and stop the old one.

When you contact the Done team about a client, give the client ID. Never send the client secret.

## See also

- [Done ID for partner apps](/)