OAuth 2.0
Configure a client
Register redirects and keep DocID® credentials separated by environment.
Create or obtain a DocID® client for the website asset before starting development.
Required values
- Client ID
- Client secret for a confidential server-side client
- DocID® issuer or base URL for the environment
- One or more registered redirect URIs
- The asset ID when using asset-specific metadata or business API resources
Redirect URI rules
DocID® compares the callback with the registered URI exactly. Register each real callback rather than using a wildcard.
These are different redirect URIs:
https://example.com/auth/docid/callbackhttps://www.example.com/auth/docid/callbackhttps://example.com/auth/docid/callback/Query strings and ports are part of the value too. Use HTTPS outside a controlled local development setup.
Authorization server metadata
Asset-specific authorization-server metadata is available at:
/oauth2/{assetId}/.well-known/oauth-authorization-server?env={environment}Use the asset ID and environment supplied for your integration. Metadata discovery helps avoid hardcoding endpoint URLs, but it does not replace correct client and redirect registration.
Store the secret
Keep the client secret in a server-side secret manager or protected environment variable. Never commit it, expose it through a client-visible environment variable, embed it in a mobile or browser bundle, or send it to analytics.