Building a client - Notifique

Architecture summary before you code. Copy-paste flow: Quick Start. Deep dive: Technical guide.

Public vs confidential

Type	Secret	Typical	Token endpoint
Confidential	Yes	Web + backend	`client_secret_basic` + PKCE
Public	No	SPA, mobile, CLI	`none` + PKCE

Never put client_secret in browser JavaScript or mobile apps. Use a public client + PKCE.

One-line flow

Register → authorize (browser + PKCE) → token → /v1 with Bearer → refresh on expiry → revoke on disconnect.

Production checklist

Exact redirect URI (trailing slash matters)
Validate state on callback
Keep code_verifier until token exchange
Persist refresh tokens atomically (they rotate)
Minimum scopes at authorize

Next steps

Technical guide
Scopes
OpenAPI under More