Skip to main content

OAuth2 Credentials

Create and manage OAuth2 credentials for your own integrations or on behalf of an affiliate or advertiser.

OAuth2 credentials let an application access the Trackdesk API without you pasting a personal token into it. Use them for server-to-server integrations, or for apps where a user signs in to Trackdesk and approves the access themselves. Each set of credentials belongs to one account and works with that account's permissions.

For how this fits with personal tokens and AI assistants, see Connect to Trackdesk: API, MCP and AI Assistants.

💡 Tip: Connecting Claude, ChatGPT or another AI assistant? You don't need to create anything here. The assistant registers itself, and you only approve the access. See Trackdesk MCP Server.


​

Where to find OAuth2 credentials

Navigate to Settings → Integrations → OAuth2. The page has these sections:

  • Connect Trackdesk to Claude: A banner with the Add to Claude button and your MCP server URL for other clients.

  • OAuth2 credentials: All credentials in your program, split into Admin, Affiliate and Advertiser tabs. Each tab shows how many credentials it holds, and the Advertiser tab appears only in network programs.

  • OAuth2 credentials permissions: Whether your affiliates and advertisers can create their own credentials and connect their own applications.


​

Create OAuth2 credentials

  1. Navigate to Settings → Integrations → OAuth2.

  2. In OAuth2 credentials, open the tab for the role the credentials are for: Admin, Affiliate or Advertiser.

  3. Click Create new credentials.

  4. Fill in the fields described below.

  5. Click Create new credentials to confirm.

You'll see the following fields:

  • Account: The affiliate or advertiser the credentials belong to. Shown only on the Affiliate and Advertiser tabs, and lists only enabled accounts. The application only reaches that account's own data.

  • Credentials name: A short name that helps you recognize the integration later, up to 255 characters. It is also the name users see on the approval screen.

  • Credentials type: Confidential for server-side integrations that can keep a secret safe. Public for mobile, desktop or single-page apps that can't. Public credentials have no client_secret, must use PKCE, and can't use the client_credentials grant.

  • Redirect URIs: The exact addresses Trackdesk can send users back to after they approve access, one per line. Use HTTPS; HTTP is accepted only for local development (loopback addresses such as http://127.0.0.1, on any port). Leave it empty for a machine-to-machine integration that only uses client_credentials. Public credentials need at least one.

Credentials you create on the Admin tab belong to your own account.

After you confirm, the OAuth2 credentials created window shows the client_id and, for confidential credentials you create for your own account, the client_secret. For credentials you create for an affiliate or advertiser, the window shows no client_secret: only the account the credentials belong to can see it, and its owner gets one by rotating the secret.

⚠️ Important: Copy the client_secret and store it securely right away. It is shown only once and can't be retrieved later.


​

How applications use the credentials

  • Machine-to-machine (client_credentials): Your server exchanges the client_id and client_secret for an access token directly. No one has to sign in. Available for confidential credentials only.

  • User-approved access (authorization_code with PKCE S256): The application sends the user to https://TENANT_ID.trackdesk.com/oauth/authorize. The user signs in, sees which application is asking and where they'll be returned, and clicks Allow access or Deny. The application then acts as that user.

Access tokens are valid for 1 hour. Refresh tokens are valid for 30 days and are replaced with a new one every time they're used. If a refresh token is used twice, Trackdesk revokes that whole authorization, and it shows up in the activity log.

The approval screen doesn't open inside an embedded window. If the application shows it in a frame, the user is asked to open it in a new window instead. For the token endpoints, see Public API: Overview of Available Actions.


​

Applications that register themselves

AI assistants such as Claude and ChatGPT, and other MCP clients, create their own credentials when someone connects them. Nobody has to fill in a form: the user pastes the server URL, signs in and approves the access.

These credentials show Registered by the application itself as the owner. They can't access anything until a user approves them, and registrations that nobody approves are deleted within two hours. Each account that connects the application gets its own credentials, so deleting them disconnects only that account.


​

Manage OAuth2 credentials

Each row in OAuth2 credentials shows the credentials name, owner and creation date. To see the rest, click the eye icon on the row: the details window shows the credentials type, the client_id with a copy button, and the registered redirect URIs. The following actions are available on the row:

  • Rotate secret: Issues a new client_secret and invalidates the current one. Integrations using the old secret stop working until you update them. Access tokens obtained with client_credentials stop working at once; tokens issued to users who approved the application keep working until they expire. You can rotate only the secret of credentials you own, and public credentials have no secret to rotate.

  • Delete: Removes the credentials. Every access and refresh token issued through them stops working immediately, and the application is disconnected.


​

Disconnect an application

To disconnect an application, click Delete on its credentials row in OAuth2 credentials. The application loses access immediately, and the account has to approve it again to reconnect.

Applications that registered themselves, such as AI assistants, are listed on the Admin tab. Affiliates and advertisers delete their own credentials under Tools → Integrations → OAuth2.


​

Let affiliates and advertisers connect their own applications

By default, only you and your team can create OAuth2 credentials. To let affiliates (and advertisers, in network programs) create their own credentials and connect applications such as AI assistants:

  1. Navigate to Settings → Integrations → OAuth2.

  2. In OAuth2 credentials permissions, switch on Allow affiliates and advertisers to create their own OAuth2 credentials.

  3. Click Save.

Your affiliates and advertisers then find an OAuth2 page under Tools → Integrations. There they can create, rotate and delete their own credentials; deleting credentials also disconnects the application. Below their credentials, an API reference row links to the API reference and shows Your account ID and Your revenue origin ID to copy.

While the option is off, an affiliate or advertiser who tries to approve an application sees: "Your account is not allowed to authorize applications. Sign in with a different account to continue." To verify the setting, sign in as an affiliate and open Tools → Integrations → OAuth2.

Switching the option off stops new credentials from being created. Existing credentials keep working, and affiliates who already have some still see the page so they can delete them. You can still create credentials for any affiliate or advertiser from the Affiliate and Advertiser tabs, whichever way the option is set.


​

Important notes

  • Treat the client_secret like a password. If it is compromised, rotate the secret or delete the credentials immediately.

  • While you're impersonating an affiliate or advertiser, their OAuth2 page under Tools → Integrations opens. You can create and delete their credentials, but the client_secret isn't shown, and Rotate secret and Connected applications aren't available.

  • If you prefer a single static key, use a personal token instead.

Related Articles
Did this answer your question?