diff --git a/astro.config.mjs b/astro.config.mjs index dbff7e4a3..4012a132c 100644 --- a/astro.config.mjs +++ b/astro.config.mjs @@ -132,6 +132,8 @@ export default defineConfig({ // Build section subfolder redirects "/build/applications/": "/build/applications/about-applications/", + "/build/applications/add-and-manage-applications/": + "/build/applications/about-applications/", "/build/domains/": "/build/domains/pointing-your-domain/", "/build/env-variables/": diff --git a/src/content/docs/authenticate/device-authorization-flow/overview.mdx b/src/content/docs/authenticate/device-authorization-flow/overview.mdx index e3ed7fc77..6d5f5a557 100644 --- a/src/content/docs/authenticate/device-authorization-flow/overview.mdx +++ b/src/content/docs/authenticate/device-authorization-flow/overview.mdx @@ -90,7 +90,7 @@ The device must poll the token endpoint at regular intervals until the user comp - **Initial interval**: Use the `interval` value from the device authorization response (typically 5 seconds). - **Slow down**: If you receive a `slow_down` error, increase the polling interval by 5 seconds. -- **Maximum time**: Stop polling after the `expires_in` time (typically 30 minutes). +- **Maximum time**: Stop polling after the `expires_in` time (typically 10 minutes). ## Device authorization flow error codes diff --git a/src/content/docs/authenticate/device-authorization-flow/troubleshooting.mdx b/src/content/docs/authenticate/device-authorization-flow/troubleshooting.mdx index 3ce107227..f00ee857b 100644 --- a/src/content/docs/authenticate/device-authorization-flow/troubleshooting.mdx +++ b/src/content/docs/authenticate/device-authorization-flow/troubleshooting.mdx @@ -74,7 +74,7 @@ if (error === "access_denied") { ### expired_token **Error**: `expired_token` -**Description**: The device code has expired (typically after 30 minutes). +**Description**: The device code has expired (typically after 10 minutes). **Solution**: Request a new device code. diff --git a/src/content/docs/authenticate/manage-authentication/manage-authentication-applications.mdx b/src/content/docs/authenticate/manage-authentication/manage-authentication-applications.mdx index 2848a0f0c..80b9230a2 100644 --- a/src/content/docs/authenticate/manage-authentication/manage-authentication-applications.mdx +++ b/src/content/docs/authenticate/manage-authentication/manage-authentication-applications.mdx @@ -30,7 +30,7 @@ updated: 2025-01-16 If you want, you can select different authentication methods for different applications. You might want to do this, for example, so users sign in with Google for your Android app and Apple for your iOS app. -You first need to [set up all your auth methods](/authenticate/authentication-methods/set-up-user-authentication/) and [set up each application](/build/applications/add-and-manage-applications/). +You first need to [set up all your auth methods](/authenticate/authentication-methods/set-up-user-authentication/) and [set up each application](/build/applications/about-applications/). 1. Go to **Settings > Environment > Applications**. 2. Select **View details** on the application you want to edit. diff --git a/src/content/docs/build/applications/about-applications.mdx b/src/content/docs/build/applications/about-applications.mdx index 33db848d8..1b4612b05 100644 --- a/src/content/docs/build/applications/about-applications.mdx +++ b/src/content/docs/build/applications/about-applications.mdx @@ -1,17 +1,24 @@ --- page_id: 4a46eba1-598a-4804-b669-dc96f31d2205 -title: Applications in Kinde -description: Comprehensive overview of Kinde applications including backend, frontend, and machine-to-machine applications with OAuth 2.0 flows and security considerations. +title: About applications in Kinde +description: Overview of Kinde application types—back-end web, front-end and mobile, M2M, and Device and IoT—including OAuth 2.0 flows, configuration, and management in the dashboard. sidebar: order: 1 + label: About applications +tableOfContents: + maxHeadingLevel: 3 relatedArticles: - - 6c70b7ae-1b1b-43bb-bea1-9b3ec88dd082 - 38d2394f-f064-47a1-89d0-078597b78412 - 6bf993fc-a195-4836-8eaf-133812be8876 + - 7e861737-04c6-4f69-bf83-84b5f40f1962 +app_context: + - m: settings + s: applications topics: - applications - oauth - authentication + - authorization sdk: [] languages: [] audience: developers @@ -19,83 +26,218 @@ complexity: intermediate keywords: - applications - OAuth 2.0 - - authorization flows - - backend apps - - frontend apps - - M2M apps + - authorization code flow + - PKCE - client credentials -updated: 2024-01-15 + - machine to machine + - device authorization flow + - back-end web apps + - front-end apps + - mobile apps + - IoT applications +updated: 2026-06-10 featured: false deprecated: false -ai_summary: Comprehensive overview of Kinde applications including backend, frontend, and machine-to-machine applications with OAuth 2.0 flows and security considerations. +ai_summary: "This page explains what Kinde applications are and how they connect products and services to Kinde for authentication and authorization. It covers four application types: Back-end web apps using the Authorization Code Flow with a client secret for server-rendered applications; Front-end and mobile apps using Authorization Code Flow with PKCE for SPAs, web browsers, and native mobile clients in untrusted environments; Machine to machine (M2M) apps using the Client Credentials grant for backend services, APIs, CLIs, and the Kinde Management API with scope-based access; and Device and IoT apps using the OAuth 2.0 Device Authorization Grant (RFC 8628) for input-limited devices like smart TVs and gaming consoles. The page lists compatible SDKs for each type, notes that Kinde does not support the Implicit Flow, and explains M2M token properties and device flow polling, audiences, and default app settings. It also walks through adding, configuring, and deleting applications in the Kinde dashboard, including app keys, callback URLs, authentication methods, tokens, sessions, and permanent deletion requirements." --- -Applications in Kinde facilitate the receipt of access tokens in your application’s code. Kinde applications use OAuth 2.0 flows to securely pass tokens. +In Kinde, an application represents a product or service that connects to Kinde for authentication and authorization—such as a website, mobile app, or backend API. Each application type uses OAuth 2.0 flows to securely obtain access tokens (and, where applicable, ID tokens) that your code can use to identify users or call protected APIs. -See [Section 4 of the OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749#section-4) for details on Authorization flows. +Kinde supports the following application types: -We support the following applications and flows. +1. **Back-end web**: For server-rendered web applications +2. **Front-end and mobile**: For client-side web and native mobile applications, including JavaScript-based single page applications (SPAs) +3. **Machine to machine (M2M)**: For trusted back-end services, APIs, and other systems that act on their own behalf +4. **Device and IoT**: For devices with limited input capabilities, such as smart TVs, gaming consoles, and IoT applications -## Back-end / server-side apps + ![kinde application types](https://imagedelivery.net/skPPZTHzSlcslvHjesZQcQ/297a6959-eefe-496d-463a-6da163997300/socialsharingimage) -Use for server-rendered web applications. Suitable for confidential applications (such as Regular Web Applications) because the application's authentication methods are included in the exchange and must be kept secure. +## Supported app types -### Secured with Authorization Code Flow +### Back-end web + +Use for server-rendered web applications. Suitable for confidential applications (such as Regular Web Applications) because credentials like the client secret can be stored securely on the server. + +#### Secured with Authorization Code Flow This application uses the Authorization Code Flow to exchange an authorization code for a token. -For security, a client secret is required to request an access token. The client secret is known only to the application and the authorization server. So when the application makes a request for an access token, it includes the client secret as a form of authentication. This ensures that the authorization server can verify the identity of the client application. +For security, a client secret is required to request an access token. The client secret is known only to the application and the authorization server. When the application makes a request for an access token, it includes the client secret as a form of authentication. This ensures that the authorization server can verify the identity of the client application. The use of client secrets protects sensitive data from being accessed by unauthorized users and systems. -### SDKs and compatible frameworks +#### Compatible back-end SDKs -Apollo GraphQL, Elixir, ExpressJS, Express GraphQL, Java, .NET, Next.js, NodeJS, Nuxt, PHP, Python, Ruby, TypeScript. +- [NextJS App Router](/developer-tools/sdks/backend/nextjs-sdk/) and [NextJS Pages Router](/developer-tools/sdks/backend/nextjs-prev-sdk/) +- [TanStack Start React](/developer-tools/sdks/backend/tsr-sdk/) +- [Go SDK](/developer-tools/sdks/backend/go-sdk/) +- [Python SDK](/developer-tools/sdks/backend/python-sdk/) -[View Kinde SDKs](/developer-tools/about/our-sdks/) +See the full list of [Kinde back-end SDKs](/developer-tools/about/our-sdks/#back-end). -## Front-end / client-side apps +### Front-end and mobile -Use for client-side web applications, single page web applications, and mobile applications. Authentication methods are different for these apps because they run in unsecured systems, such as web browsers. +Use for client-side web applications, single page web applications, and mobile applications. Authentication methods are different for these apps because they run in untrusted environments, such as web browsers and mobile devices. -### Secured with Authorization Code Flow and PKCE +#### Secured with Authorization Code Flow and PKCE This application uses the Authorization Code Flow with Proof Key for Code Exchange (PKCE). -Client-side applications, such as single-page web apps, are typically unable to securely store a client secret due to the inherent exposure of client-side code. That’s why OAuth 2.0 recommends the Implicit Flow or PKCE (Proof Key for Code Exchange) to provide security without relying on a client secret. - -