FerriskeyClients
A client represents an application that authenticates through FerrisKey. Every OAuth2 and OIDC flow starts with one: it says which application is asking for access, and it determines which authentication methods and token settings apply.
Client types
There are three:
| Type | Secret | Use case |
|---|---|---|
| Confidential | Yes | Server-side applications that can keep a secret |
| Public | No | Single-page apps, mobile apps, CLI tools |
| System | None | Internal FerrisKey clients, created automatically and not user-managed |
Choosing a client type
Pick confidential when your application has a backend that can hold the secret safely. Pick public for anything running in a browser or on a device, where the secret would end up in the user’s hands anyway.
Client properties
| Property | Description |
|---|---|
client_id | Public identifier used in OAuth2 flows |
secret | Client secret (confidential clients only) |
protocol | Protocol type (e.g., openid-connect) |
enabled | Whether the client can initiate authentication |
redirect_uris | Allowed redirect URIs after authentication |
direct_access_grants_enabled | Allow the password grant type |
service_account_enabled | Enable client credentials grant |
Token lifetime overrides
Clients inherit token lifetimes from their realm. Override them per client when one application needs a different window:
| Override | Description |
|---|---|
access_token_lifetime | Access token TTL in seconds |
refresh_token_lifetime | Refresh token TTL in seconds |
id_token_lifetime | ID token TTL in seconds |
temporary_token_lifetime | Temporary token TTL in seconds |
A value set on the client wins over the realm default. Leave it null and the realm default applies.
Direct access grants
With this enabled, a client can use the resource owner password credentials grant, sending a username and password straight to the token endpoint. It is handy for trusted first-party applications and for testing. Do not enable it for third-party clients.
Service accounts
A client with service_account_enabled can authenticate through the client credentials grant, with no user involved. FerrisKey creates a linked service account user for it, and that user takes roles and permissions like any other.
This is the usual pattern for machine to machine calls.