Register Your App

To build an app that connects to Orshot on behalf of users, you need a client ID and client secret. Register your app through our Developer Program and we'll review it.

What You'll Need to Provide#

When registering your app, include the following details:

Register Your App#

Sign in to your Orshot account and submit your app through the Developer Program:

What Happens Next#

1. Submit your app — Fill out the registration form with your app details
2. Start building — Your client_id and client_secret are available immediately in the Developer Program dashboard
3. Test in development mode — Only you (and any test users you added) can authorize the app
4. Submit for review — When ready, submit your app for publishing to make it available to all users

Development Mode#

All new apps start in development mode (private). While in development mode:

• Only the app owner and explicitly added test users can authorize the app
• Other users who attempt to authorize will see an access_denied error
• API calls made with tokens from unauthorized users will return a sandbox_restricted error
• The consent screen shows an "unverified app" warning to test users

This mirrors how platforms like Google and Shopify handle app development — you can build and test safely before going live.

Redirect URI Rules#

Orshot validates redirect URIs strictly. Here's what's supported:

• HTTPS URLs — https://your-app.com/callback (required for production)
• Localhost — http://localhost:3000/callback (any port, for development)
• Custom schemes — vscode://your-extension/callback, cursor://, claude:// (for IDE extensions and desktop apps)

You can register multiple redirect URIs. The redirect_uri parameter in the authorization request must exactly match one of the registered URIs (localhost ports are flexible).

Keep Your Secret Safe#

• Never expose your client_secret in client-side code (browser JavaScript, mobile apps)
• Store it in environment variables or a secrets manager
• If your secret is compromised, email us immediately for rotation
• For public clients (SPAs, mobile apps), use PKCE without a client secret