OAuth2 / OIDC Clients

Muljax ID includes a built-in OpenID Connect (OIDC) and OAuth 2.0 authorization server. Administrators manage client applications via Admin -> Clients (/admin/clients).

Application Profiles

When creating a client application, three profiles are supported:

Profile	Client Type	Authentication Method	Use Case
Web Application	confidential	PKCE (S256) + Client Secret	Traditional backend web applications (Node.js, Go, Python, Rails)
SPA / Native	public	PKCE (S256) strictly	Browser single-page apps (React, Vue) and mobile applications
Machine-to-Machine	confidential	Client Credentials Grant	Backend microservices, CI/CD runners, and background daemons

---

Pre-Seeded Clients: Muljax CLI

Muljax ID automatically provisions the official CLI client into Cloudflare D1 upon deployment via bun run deploy (or bun run seed):

• Client ID: muljax-cli
• Name: Muljax CLI
• Client Type: public (PKCE S256 strictly enforced; no client secret required)
• Redirect URIs:
  • http://127.0.0.1/callback (permits dynamic ephemeral loopback ports per RFC 8252 §7.3)
  • http://localhost/callback
• Allowed Scopes:
  • Standard OIDC: openid, profile, email, offline_access
  • SSH Capabilities: ssh:cert:issue, ssh:ca:read, ssh:keys:manage

This record is maintained idempotently across deployments by scripts/seed-d1.ts (ON CONFLICT (id) DO UPDATE), ensuring redirect URIs and scopes stay aligned with the latest CLI capabilities.

---

Managing Applications in the Dashboard

1. Registering an Application

1. Navigate to Admin -> Clients (/admin/clients).

2. Click Add Client.

3. Configure the client:

   • Name: Display title shown on user consent prompts (e.g., "Grafana Monitoring").
   • Profile: Choose Web Application, SPA / Native, or Machine-to-Machine.
   • Redirect URIs: Enter valid callback URLs (one per line, e.g., https://grafana.example.com/login/generic_oauth).
   • Allowed Scopes: Toggle standard OIDC scopes (openid, profile, email, offline_access).

4. Click Create Client.

2. Client Credentials View

For confidential clients, the creation dialog presents your generated credentials:

• client_id: Permanent identifier for your application.
• client_secret: High-entropy secret string.

Copy Secret Immediately

The plaintext client secret is shown only once upon creation. The server hashes secrets with SHA-256 before storing them in oauth_clients.client_secret_hash. It cannot be retrieved later.

---

Deleting an Application

To delete an application:

1. Locate the client card in the directory.
2. Click the delete icon.
3. Confirm deletion in the modal.

All active authorization codes, refresh tokens, access tokens, and user consent grants bound to that client are deleted immediately via database cascade.