> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nemu.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Applications

> OAuth clients for the management API

An application is an OAuth 2.0 client. It is how a program reads and changes
your account settings: workspaces, providers, models, keys, quotas, usage.

This is a different credential from an [API key](/console/keys). A key calls
models through the gateway. An application calls the management API. Neither
does the other's job.

Applications live in **Settings**, under Applications, not inside a workspace.
They belong to your account and reach every workspace you have.

## Creating one

| Field         | Notes                                           |
| ------------- | ----------------------------------------------- |
| Name          | Unique across your applications                 |
| Description   | Optional                                        |
| Grant types   | Client credentials, authorization code, or both |
| Redirect URIs | Required for authorization code, up to 20       |
| Scopes        | What the application may reach                  |

You get back a client id starting `cl_` and a client secret starting `cls_`.

**The secret is shown once.** It is sealed after that and cannot be read back.
If you lose it, regenerate it, which invalidates the old one immediately.

Selecting **authorization code** adds `refresh_token` automatically, since a
user facing app needs to refresh without sending the user back through consent.

## Grant types

**Client credentials** is for your own backend acting as itself. No user is
involved. See [Client credentials](/oauth/client_credentials).

**Authorization code** is for acting on behalf of another nemu user, who
approves the scopes on a consent screen. See
[Authorization code](/oauth/authorization_code).

## Scopes

Scopes are requested when the application is created and cannot be widened by
the token request. Asking for more than the application holds fails.

| Scope                                    | Grants                                     |
| ---------------------------------------- | ------------------------------------------ |
| `profile:read`                           | Read the account profile                   |
| `workspaces:read` / `:write` / `:delete` | Read, create and update, delete workspaces |
| `members:read` / `:write`                | Read members, manage members and invites   |
| `budget:read` / `:write`                 | Read and set the workspace spend cap       |
| `providers:read` / `:write`              | Read and manage providers                  |
| `models:read` / `:write`                 | Read models and workflows, manage models   |
| `mapping:read` / `:write`                | Read and manage mappings                   |
| `prompts:read` / `:write`                | Read and manage prompts                    |
| `keys:read` / `:write`                   | Read and manage API keys                   |
| `quotas:read` / `:write`                 | Read and manage quota rules                |
| `indexes:read` / `:write`                | Read and manage website indexes            |
| `usage:read`                             | Read metrics and usage                     |

Grant the narrowest set that works. Full detail is in [Scopes](/oauth/scopes).

## Managing them

**Disable** stops the application issuing new tokens without deleting it.
**Delete** is permanent and revokes every token it ever issued.

**Authorized apps** is the other side of the same page: applications, yours or
someone else's, that you have granted access to your own account. Revoking one
there cuts its access immediately.

## Next

* [OAuth 2.0 overview](/oauth)
* [Quickstart](/oauth/quickstart)
* [SDK](/oauth/sdk)