Requesting access
What to send when asking Gigadrive for an OAuth client, what you get back, and what you can change later.
Access is granted per request
Client registration is not self-service and there is no dynamic registration endpoint. Request a client from Gigadrive
at cs@gigadrive.de.
An OAuth client is the record that lets your application start a sign-in against Gigadrive IDP. Without one, the authorize endpoint answers invalid_client and nothing else happens.
What to include in the request
| Detail | Why it is needed |
|---|---|
| What you are building | The review weighs what the client is for, beyond its parameters |
| Application name | Shown on the consent screen, so users see something they recognize |
| Redirect URIs | Every URI your callback can land on. Requests to any other URI are rejected |
| Public or confidential | Whether the client can keep a secret. A browser or desktop app cannot; a server-side app can |
| Scopes | The narrowest set that works. See Scopes and claims |
| The Gigadrive Network application, if any | Binding the client to an application is what makes the AI Gateway governance scopes reachable |
Say if you need the device flow. It has no redirect URI and no PKCE, and it is how a terminal signs a person in.
What you receive
- A client id, a UUID. It is not a secret and it appears in every authorize URL.
- A client secret, for confidential clients only. Gigadrive stores a hash, so it is shown once and cannot be recovered. Public clients get none and use PKCE instead.
- The registered redirect URIs, exactly as you gave them.
How redirect URIs are matched
Matching is exact on protocol, hostname, path, and query string. A candidate URI that differs anywhere is refused with invalid_request and the user is never sent to it.
Ports are the one exception. For a registered localhost or 127.0.0.1 URI the port is ignored, and the two hostnames are treated as equivalent, so a local development callback can bind whatever port is free. Everything else must match, with 80 and 443 normalized against their scheme.
Register the callback path you will actually use. Adding a URI later means another request.
After the client exists
Consent is shown on every sign-in. An earlier approval is recorded, and it does not shorten the next one, so design the flow around a user who sees the screen each time.
The prompt is skipped only for clients Gigadrive staff have marked trusted, that are bound to an application, whose sign-in policy opts in, and that request nothing beyond openid, profile, and email. That last condition is not configurable: offline_access in particular is excluded, because it mints a refresh token that lives 30 days.
Rotating a secret, adding a redirect URI, or widening the scope set all go back through cs@gigadrive.de.