> ## Documentation Index > Fetch the complete documentation index at: https://docs.flexslot.gg/llms.txt > Use this file to discover all available pages before exploring further. # Create a new OAuth2 client > Creates an OAuth2 client for the PAT user's partner. Confidential clients receive a plaintext secret in the response exactly ONCE; public clients receive an empty secret (PKCE only). Subject to a per-partner client limit. ## OpenAPI ````yaml /openapi.json post /api/public/v1/me/partner/oauth2-clients openapi: 3.0.3 info: title: Flexslot API version: 1.0.0 description: API documentation for Flexslot decks application servers: - url: https://api.flexslot.gg description: Production - url: https://api-dev.flexslot.gg description: Development security: [] paths: /api/public/v1/me/partner/oauth2-clients: post: tags: - Me summary: Create a new OAuth2 client description: >- Creates an OAuth2 client for the PAT user's partner. Confidential clients receive a plaintext secret in the response exactly ONCE; public clients receive an empty secret (PKCE only). Subject to a per-partner client limit. operationId: me_partner_oauth2_clients_create requestBody: content: application/json: schema: $ref: '#/components/schemas/OAuth2ClientCreateRequestRequest' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/OAuth2ClientCreateRequestRequest' multipart/form-data: schema: $ref: '#/components/schemas/OAuth2ClientCreateRequestRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/OAuth2ClientSecretResponse' description: '' security: - PersonalAccessToken: [] - OAuth2Bearer: [] components: schemas: OAuth2ClientCreateRequestRequest: type: object properties: application_name: type: string minLength: 1 maxLength: 255 client_type: allOf: - $ref: '#/components/schemas/OAuth2ClientCreateRequestClientTypeEnum' default: confidential redirect_uris: type: array items: type: string minLength: 1 maxLength: 512 allowed_scopes: type: array items: $ref: '#/components/schemas/AllowedScopesEnum' grant_types: type: array items: $ref: '#/components/schemas/GrantTypesEnum' default: - authorization_code - refresh_token application_url: type: string default: '' maxLength: 512 application_logo_url: type: string default: '' maxLength: 512 privacy_policy_url: type: string default: '' maxLength: 512 tos_url: type: string default: '' maxLength: 512 required: - allowed_scopes - application_name - redirect_uris OAuth2ClientSecretResponse: type: object properties: client: $ref: '#/components/schemas/OAuth2ClientSelf' plaintext_client_secret: type: string secret_rotated_at: type: string format: date-time nullable: true required: - client - plaintext_client_secret - secret_rotated_at OAuth2ClientCreateRequestClientTypeEnum: enum: - confidential - public type: string description: |- * `confidential` - confidential * `public` - public AllowedScopesEnum: enum: - cards:read - decks:read - decks:write - exports:read - guides:read - guides:write - sideboards:read - sideboards:write type: string description: |- * `cards:read` - cards:read * `decks:read` - decks:read * `decks:write` - decks:write * `exports:read` - exports:read * `guides:read` - guides:read * `guides:write` - guides:write * `sideboards:read` - sideboards:read * `sideboards:write` - sideboards:write GrantTypesEnum: enum: - authorization_code - refresh_token type: string description: |- * `authorization_code` - authorization_code * `refresh_token` - refresh_token OAuth2ClientSelf: type: object properties: id: type: string format: uuid readOnly: true client_id: type: string readOnly: true client_type: allOf: - $ref: '#/components/schemas/OAuth2ClientTypeEnum' readOnly: true application_name: type: string readOnly: true application_url: type: string format: uri readOnly: true application_logo_url: type: string format: uri readOnly: true privacy_policy_url: type: string format: uri readOnly: true tos_url: type: string format: uri readOnly: true redirect_uris: type: array items: type: string maxLength: 512 readOnly: true allowed_scopes: type: array items: type: string maxLength: 64 readOnly: true grant_types: type: array items: type: string maxLength: 32 readOnly: true require_pkce: type: boolean readOnly: true dpop_bound_access_tokens: type: boolean readOnly: true status: allOf: - $ref: '#/components/schemas/OAuth2ClientStatusEnum' readOnly: true secret_rotated_at: type: string format: date-time readOnly: true nullable: true last_used_at: type: string format: date-time readOnly: true nullable: true created_at: type: string format: date-time readOnly: true updated_at: type: string format: date-time readOnly: true required: - allowed_scopes - application_logo_url - application_name - application_url - client_id - client_type - created_at - dpop_bound_access_tokens - grant_types - id - last_used_at - privacy_policy_url - redirect_uris - require_pkce - secret_rotated_at - status - tos_url - updated_at OAuth2ClientTypeEnum: enum: - confidential - public type: string description: |- * `confidential` - Confidential * `public` - Public x-enum-varnames: - CONFIDENTIAL - PUBLIC x-enum-descriptions: - Confidential - Public OAuth2ClientStatusEnum: enum: - active - suspended - revoked type: string description: |- * `active` - Active * `suspended` - Suspended * `revoked` - Revoked x-enum-varnames: - ACTIVE - SUSPENDED - REVOKED x-enum-descriptions: - Active - Suspended - Revoked securitySchemes: PersonalAccessToken: type: http scheme: bearer bearerFormat: flx_pat_... description: 'User-issued personal access token (format: flx_pat_).' OAuth2Bearer: type: http scheme: bearer bearerFormat: flx_at_... description: >- OAuth2 access token issued via the authorization-code + PKCE flow (format: flx_at_). Grants the partner user-scoped access to act on behalf of the consenting end-user. ````