OAuth clients

Registered clients

Registrations live in DynamoDB. New clients get a random UUID as client_id (you cannot choose it). Each client has a description, owner email, optional allowed sign-in emails (who may complete JumpCloud login for that client), OAuth scopes, and redirect URIs. Public clients must use PKCE at the token endpoint.

Register new client

Description Owner email Redirect URIs (one per line or comma-separated; exact match at authorize) Allowed sign-in emails (optional; one per line or comma-separated. JumpCloud ID token email must match. Empty = any user who passes global JumpCloud policy.)

Allowed scopes

openid is always required. Requests at authorize must be a subset of what you allow here.

Require global JumpCloud org allowlist (JUMPCLOUD_ALLOWED_ORG_IDS). Turn off to skip org checks for this client (email / domain allowlists still apply). Public client (PKCE required; no client secret)