Changing an app’s settings

Change what your app may do, pause it, or delete it, from its Settings tab in the developer console. Each change takes effect at once, for users already signed in too.

Before you start

• You need an app you registered. Open it from Your apps, at auth.sourceorigin.dev/developers, then select its Settings tab.
• Every change needs a passkey confirmation from the last five minutes. If yours is older, your browser asks for your passkey before the change is sent.

Change the settings

1. Change the settings in the form. Settings explains each one.
2. Select Save changes.

The page says Your changes were saved. A setting auth refuses is explained beside its input, and nothing is saved.

What a change does to users already signed in:

• Removing a redirect URI or a scope stops the sign-ins under way that use it, and the codes not yet exchanged. A refresh token that holds a removed scope is refused at its next use, and stops working for good.
• Turning off Allow refresh tokens refuses every refresh token at its next use, for good, so users sign in again.
• Turning on Require pushed authorization requests stops the sign-ins under way that came through the browser.
• Renaming the app changes what the consent screen shows. Users who already consented aren’t asked again.

Disable an app

Disabling pauses an app: it can’t sign users in, exchange codes or refresh tokens until you enable it again.

1. Under Danger zone, select Disable.

The page says The app was disabled., and the app shows Disabled. Sign-ins under way and codes not yet exchanged stop. Access tokens the app already holds keep working until they expire, within five minutes.

Disabling keeps your users’ refresh tokens and consents. To pause an app because its secret or a token leaked, rotate the secret too, or delete the app.

Enable an app

1. Under Danger zone, select Enable.

The page says The app was enabled. Users’ refresh tokens work again, and users who consented aren’t asked again.

Delete an app

Warning: deleting an app can’t be undone, and its client ID is never used again, by you or anyone else.

1. Under Danger zone, select Delete.
2. Check the name in Delete “<name>”?, then select Delete for good.

The console goes back to Your apps and says The app was deleted. The app stops working at once: its refresh tokens are revoked, and its secrets and the consents users gave it are removed. Its name and URIs are erased, so users’ security histories show it only as an app. Deleting it frees its place among your 10 apps.

Check that it works

Open the app’s Overview tab. It shows the app’s scopes, redirect URIs and back-channel logout URI as auth now applies them, and says so when the app is disabled or suspended. Then sign in to your app. A disabled app’s sign-in stops at auth, which answers instead of sending the browser back to your app:

{"error":"invalid_request","error_description":"client_id is not a registered, enabled client"}

Troubleshooting

• The app shows Suspended. An administrator suspended it, for example because it was abused. It can’t sign users in, and you can’t enable it until they lift the suspension, after which it is disabled until you enable it. You can still change its settings and delete it. Write to [email protected] to restore it.
• A redirect URI is refused with “must be written as …”. Write it as the message shows, which is how your app’s library sends it: for example https://app.example/, not https://APP.example.
• Users sign in again after a change. Removing a scope or turning off refresh tokens ends the refresh tokens that relied on them.

Settings

The kind of app, with a backend or without, can’t change: register a new app instead.