OAuth2 credentials let an application access the Trackdesk API without you pasting a personal token into it. Use them for server-to-server integrations, or for apps where a user signs in to Trackdesk and approves the access themselves. Each set of credentials belongs to one account and works with that account's permissions.

For how this fits with personal tokens and AI assistants, see Connect to Trackdesk: API, MCP and AI Assistants.

💡 Tip: Connecting Claude, ChatGPT or another AI assistant? You don't need to create anything here. The assistant registers itself, and you only approve the access. See Trackdesk MCP Server.

Where to find OAuth2 credentials

Navigate to Settings → Integrations → OAuth2. The page has three sections:

Connected applications: Applications you have authorized to access your own account.
OAuth2 credentials: All credentials in your program, split into Admin, Affiliate and Advertiser tabs. Each tab shows how many credentials it holds. The Advertiser tab appears only in network programs.
OAuth2 credentials permissions: Whether your affiliates and advertisers can create their own credentials and connect their own applications.

Create OAuth2 credentials

Navigate to Settings → Integrations → OAuth2.
In OAuth2 credentials, open the tab for the role the credentials are for: Admin, Affiliate or Advertiser.
Click Create new credentials.
Fill in the fields described below.
Click Create new credentials to confirm.

You'll see the following fields:

Account: The affiliate or advertiser the credentials belong to. Shown only on the Affiliate and Advertiser tabs, and lists only enabled accounts. The application only reaches that account's own data.
Credentials name: A short name that helps you recognize the integration later, up to 255 characters. It is also the name users see on the approval screen.
Credentials type: Confidential for server-side integrations that can keep a secret safe. Public for mobile, desktop or single-page apps that can't. Public credentials have no client_secret, must use PKCE, and can't use the client_credentials grant.
Redirect URIs: The exact addresses Trackdesk can send users back to after they approve access, one per line. Use HTTPS; HTTP is accepted only for local development (loopback addresses such as http://127.0.0.1, on any port). Leave it empty for a machine-to-machine integration that only uses client_credentials. Public credentials need at least one.

Credentials you create on the Admin tab belong to your own account.

After you confirm, a window shows the client_id and, for confidential credentials, the client_secret.

⚠️ Important: Copy the client_secret and store it securely right away. It is shown only once and can't be retrieved later.

How applications use the credentials

Machine-to-machine (client_credentials): Your server exchanges the client_id and client_secret for an access token directly. No one has to sign in. Available for confidential credentials only.
User-approved access (authorization_code with PKCE S256): The application sends the user to https://TENANT_ID.trackdesk.com/oauth/authorize. The user signs in, sees which application is asking and where they'll be returned, and clicks Allow access or Deny. The application then acts as that user.

Access tokens are valid for 1 hour. Refresh tokens are valid for 30 days and are replaced with a new one every time they're used. If a refresh token is used twice, Trackdesk revokes that whole authorization, and it shows up in the activity log.

The approval screen doesn't open inside an embedded window. If the application shows it in a frame, the user is asked to open it in a new window instead. For the token endpoints, see Public API: Overview of Available Actions.

Applications that register themselves

AI assistants such as Claude and ChatGPT, and other MCP clients, create their own credentials when someone connects them. Nobody has to fill in a form: the user pastes the server URL, signs in and approves the access.

These credentials show Registered by the application itself as the owner. They can't access anything until a user approves them, and registrations that nobody approves are deleted within two hours. Deleting them disconnects everyone who approved that application.

Manage OAuth2 credentials

Each row in OAuth2 credentials shows the credentials name, type, owner, client_id, registered redirect URIs and creation date. The following actions are available:

Copy: Copies the client_id.
Rotate secret: Issues a new client_secret and invalidates the current one. Integrations using the old secret stop working until you update them. Access tokens obtained with client_credentials stop working at once; tokens issued to users who approved the application keep working until they expire. You can rotate only the secret of credentials you own, and public credentials have no secret to rotate.
Delete: Removes the credentials. Every access and refresh token issued through them stops working immediately, for everyone who approved the application.

Connected applications

The Connected applications section lists every application you have approved on your own account, with what it can access and when you approved it. Click the delete icon on a row to revoke that application's access. It stops working immediately and needs your approval again to reconnect.

Let affiliates and advertisers connect their own applications

By default, only you and your team can create OAuth2 credentials. To let affiliates (and advertisers, in network programs) create their own credentials and connect applications such as AI assistants:

Navigate to Settings → Integrations → OAuth2.
In OAuth2 credentials permissions, switch on Allow affiliates and advertisers to create their own OAuth2 credentials.
Click Save.

Your affiliates and advertisers then find an OAuth2 page under Tools → Integrations. There they can create, rotate and delete their own credentials and review their connected applications.

Switching the option off stops new credentials from being created. Existing credentials keep working, and affiliates who already have some still see the page so they can delete them. You can still create credentials for any affiliate or advertiser from the Affiliate and Advertiser tabs, whichever way the option is set.

Important notes

Treat the client_secret like a password. If it is compromised, rotate the secret or delete the credentials immediately.
OAuth2 pages aren't available while you're signed in as another user. Sign back in to your own account to manage credentials.
If you prefer a single static key, use a personal token instead.

OAuth2 Credentials