Application security
Application credentials
Understand which values are public, which values are secret, and which clients must use PKCE.
Credential types
| Credential | Use | Storage |
|---|---|---|
client_id | Identifies the application in authorization requests. | Public; may appear in browser code. |
client_secret | Authenticates a confidential backend during code exchange. | Server-side secret manager only. |
code_verifier | Proves the client that started an authorization is exchanging its code. | Short-lived transaction storage. |
| Webhook signing secret | Verifies outbound UnifyID webhook signatures. | Receiver secret manager only. |
Confidential clients
Backend web applications create at least one OAuth client secret. The secret is displayed once and stored only as a hash by UnifyID. Rotate it before expiry or immediately after suspected exposure.
Public clients
Browser and mobile applications cannot protect a client secret. They must use Authorization Code with S256 PKCE and must not create or embed a confidential credential.
Rotation procedure
- 1Create a replacement credential
- 2Deploy it to every backend instance
- 3Confirm successful exchanges use the new secret
- 4Revoke the previous credential
- 5Delete its inactive security record when no longer needed
A lost client secret cannot be recovered. Create a replacement. Do not send secrets through chat, email, tickets, source control, or frontend environment variables.
Use after authorization
The OAuth access token authorizes UserInfo and consented identity-document requests for a person. A client secret does not provide access to that person's identity information.