Vetrix Docs

OAuth applications

OAuth applications let software call the Vetrix API on your behalf using the OAuth2 authorization-code flow. On this page you register the applications you build, obtain and rotate their credentials, and review what a third-party application is asking for before you grant it access to your account.

Where to find it

Open your avatar menu in the top navigation bar and choose Settings, then select OAuth Applications from the Account sidebar.

URL: gitvetrix.com/settings/applications

The consent screen you see when an application asks to access your account lives at gitvetrix.com/oauth2/authorize; you reach it by following an application's sign-in link, not by navigating directly.

Register a new application

  1. Select Register new application.
  2. Enter an Application name and, optionally, a Description.
  3. Optionally add a Homepage URL and a Logo URL. Both must be absolute http:// or https:// addresses.
  4. In Redirect URIs, add one address per line. Each must use https://, except loopback addresses (http://localhost, http://127.0.0.1, or http://[::1]), which may use http://.
  5. Choose a client type: Confidential — server-side app that can keep a secret for applications that can protect a secret on a server, or Public — mobile / desktop / SPA / CLI (no secret, PKCE only) for applications that cannot.
  6. Under Scopes, select the permissions the application needs. Scopes are grouped by area (User, Repositories, Issues, CI pipelines, Packages, Audit, OpenID Connect, and MCP).
  7. Select Register application.

Confidential applications receive a client secret. It appears once, immediately after registration, alongside the new Client ID. Copy it before you leave the panel.

Copy your client ID and secret

When you register a confidential application, or when you rotate its secret, Vetrix shows the credential once in a highlighted panel:

  1. Select Copy client ID to copy the identifier (shown only on first registration).
  2. Select Copy client secret to copy the client secret.
  3. Store the secret in your application's configuration.
  4. Select Dismiss to close the panel.

The secret is not shown again after you dismiss the panel. Public applications receive no secret, so this panel does not appear for them.

Edit an application

  1. Find the application in the list and select Edit.
  2. Update the name, description, homepage URL, logo URL, redirect URIs, or scopes.
  3. Select Save changes.

You cannot change an application's client type after registration. To switch between confidential and public, register a new application.

Rotate a client secret

Rotating replaces the current secret with a new one. Available for confidential applications only.

  1. Select Rotate secret on the application's row.
  2. In the confirmation, select Rotate secret for the application.
  3. Copy the new secret from the one-time panel and update your application.

The previous secret stops working immediately, so update your application as soon as you rotate.

Delete an application

  1. Select Delete on the application's row.
  2. Type the application's name to confirm.
  3. Select Delete app to remove it.

Deleting an application is permanent and cannot be undone. It also removes all of the application's consent grants and its access and refresh tokens, so anyone currently using the application loses access.

Authorize an application

When an application asks to act on your behalf, Vetrix shows a consent screen titled Authorize followed by the application's name. Review it before you continue:

  1. Read the application name and, if shown, its homepage link and description.
  2. Review Requested permissions. Each entry names a permission, explains what it allows, and shows the underlying scope.
  3. To skip this screen the next time the same application requests the same permissions, select Remember my decision for this application.
  4. Select Authorize to grant access, or Cancel to return to the application without granting anything.

Only authorize applications you trust, and grant the fewest permissions they need. If you chose to remember your decision, a later request for the same permissions is approved automatically without showing this screen again.

Tips

  • The Client ID stays visible on each application's row after registration. Only the client secret is one-time.
  • Redirect URIs must match exactly what your application sends, including scheme, host, port, and path.
  • Public applications must use PKCE; they are issued no client secret.