OAuth Clients
Overview
Operators manage applications that ask users to authorize access to Lumio's MCP server under Admin → OAuth Clients (/oauth-clients). This is separate from Lumio's own sign-in and platform connection credentials in System Connections.
Client list
Cards show the name, enabled state, client type (public or confidential), origin, client ID, scopes, redirect URIs, live grant count and last use. Filter by origin: admin (operator-created), dcr (dynamic registration) or cimd (client ID metadata document). DCR and CIMD clients carry Not verified; that label is not a claim about the app's safety. The admin list is paginated.
Disable sets enabled to false. Lumio revokes the client's active AI-app grants, switches off automations associated with them, and sends affected users a security notice. Enable permits future authorization; it does not restore revoked grants. DCR and CIMD registrations accept only this enabled-state edit. Delete asks for confirmation and shows how many grants the client has.
Create a client
Create Client opens an inline form for a name, public or confidential type, redirect URIs, scopes and grant types. The scope picker uses the same consent groups shown to users, with only permissions the MCP catalog allows. Redirect URIs must use https with a domain name, or http on localhost, 127.0.0.1 or [::1]; plain http on another host and relative paths are refused, on create and when you change them later. Grant types contain authorization_code and may also contain refresh_token; other values are refused. New client IDs start with lm_. A confidential client's secret (lms_…) appears once after creation. Store it securely; the list never shows it again. A public client has no secret: it signs in with PKCE.
| Action | Admin permission |
|---|---|
| View clients | oauth-clients:read |
| Create | oauth-clients:create |
| Enable or disable | oauth-clients:edit |
| Delete | oauth-clients:delete |
Entering the admin app also requires admin:access and its 2FA requirement. GraphQL offers adminOAuthClients with origin and pagination arguments, adminOAuthClientsTotal, adminCreateOauthClient, adminUpdateOauthClient and adminDeleteOauthClient; REST uses /v1/admin/oauth-clients and /v1/admin/oauth-clients/\{id\}. Both use the same client validation and emit oauth_client:created, oauth_client:updated or oauth_client:deleted in the operator audit log.