New application

Its client secret is shown once, right after it is created.

Name

Homepage URL

Description

Shown to people on the consent screen, next to what the application asks for.

Logo

Drop an image or click to browse

Square image, 1 MB maximum, shown on the sign-in and consent screens. Uploaded here: links to images elsewhere are not accepted.

Application type

Decides which redirect URIs are accepted. Cannot be changed later.

Redirect URIs

One per line, matched exactly.

Post-logout redirect URIs

Optional, one per line: where the application may send people after signing them out.

Scopes

openid

Required for OpenID Connect: an ID token identifying the user.

profile

Display name, username and avatar.

accounts

Linked accounts (Discord, BeatLeader, ScoreSaber, Steam) and the game account, with their ids.

discord

The Discord user id, as a discord_id claim.

offline_access

Refresh tokens, to stay signed in without the user.

Need people's email address or their Cube Community groups? Ask [email protected], saying which application and why: an admin grants them.

Confidential client

Has a client secret (a server-side application). Off for a single-page or native app, which must use PKCE instead. Cannot be changed later.

Secret sent as

How the application authenticates at the token endpoint: any other method is refused.

Require PKCE

Keep on unless the application cannot do PKCE: its secret then authenticates it on its own.