Register an OAuth 2.0 / OpenID Connect client and people can sign in to your app with the Vampelium account they already have. A client is a credential that can ask any Vampelium account for its data, so every application is read by a moderator before one is issued, and the rules further down are enforced by the server, not just suggested here.
One application at a time. The decision arrives by email.
Enforced on every request, not on the honour system.
* is refused rather than quietly ignored.https:// everywhere, except http:// on localhost,
127.0.0.1 or [::1] so you can run your app locally.#fragment — a fragment is never sent to the server, so a registered
one could only ever fail the match.user:pass@ credentials, no whitespace, ten per client, 512 characters
each.Those four are the whole set. Anything else is refused when you save it.
Only a hash of the secret is stored, so nobody — including us — can read it back. It is shown to you once, at the moment it is created or rotated. Rotation is the only recovery, and it stops the previous secret working immediately.
Up to 25 clients per developer. Deleting a client also ends every sign-in granted through it: refresh tokens are revoked and it disappears from the connected-apps list on every account that authorised it.