<!-- llms.txt: https://workos.com/llms.txt -->

# Applications

The Applications API allows you to programmatically manage Connect Applications and their associated client secrets.

WorkOS Connect supports two types of applications: [OAuth](https://workos.com/docs/reference/workos-connect/applications/oauth) and Machine-to-Machine [M2M](https://workos.com/docs/reference/workos-connect/applications/m2m).

## Create a Connect Application

Create a new Connect Application. Supports both OAuth and Machine-to-Machine (M2M) application types.

:::code-group

```bash language="curl" title="OAuth Request" tab="1"
curl -X POST https://api.workos.com/connect/applications \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "My OAuth App",
    "application_type": "oauth",
    "description": "Customer-facing OAuth application",
    "redirect_uris": [
      {
        "uri": "https://example.com/callback",
        "default": true
      }
    ],
    "uses_pkce": false,
    "is_first_party": false,
    "organization_id": "org_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
    "scopes": ["example-permission:write"]
  }'
```

```bash language="curl" title="M2M Request" tab="2"
curl -X POST https://api.workos.com/connect/applications \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "My M2M App",
    "application_type": "m2m",
    "description": "Backend service application",
    "organization_id": "org_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
    "scopes": ["api:read", "api:write"]
  }'
```

```json language="json" title="Response" tab="3"
{
  "application_type": "oauth",
  "redirect_uris": [
    {
      "uri": "https://example.com/callback",
      "default": true
    }
  ],
  "uses_pkce": true,
  "is_first_party": true,
  "object": "connect_application",
  "id": "conn_app_01HXYZ123456789ABCDEFGHIJ",
  "client_id": "client_01HXYZ123456789ABCDEFGHIJ",
  "description": "An application for managing user access",
  "name": "My Application",
  "scopes": [
    "openid",
    "profile",
    "email"
  ],
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## Delete a Connect Application

Delete an existing Connect Application.

:::code-group{title="Request"}

```bash language="curl"
curl -X DELETE https://api.workos.com/connect/applications/app_01J9Q2Z3X4Y5W6V7U8T9S0R1Q \
  --header "Authorization: Bearer sk_example_123456789"
```

```rb language="ruby"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.connect.delete_application(id: "conn_app_01HXYZ123456789ABCDEFGHIJ")
```

```py language="python"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.connect.delete_application(id_="conn_app_01HXYZ123456789ABCDEFGHIJ")
```

```go language="go"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Connect().DeleteApplication(context.Background(), "conn_app_01HXYZ123456789ABCDEFGHIJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos->connect()->deleteApplication(id: "conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```java language="java"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.connect.deleteApplication("conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```cs language="dotnet"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Connect.DeleteApplicationAsync("conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```rust language="rust"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .connect()
        .delete_application("conn_app_01HXYZ123456789ABCDEFGHIJ")
        .await?;

    Ok(())
}
```

:::

## Get a Connect Application

Retrieve details for a specific Connect Application by ID or client ID.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/connect/applications/conn_app_01HXYZ123456789ABCDEFGHIJ" \
  --header "Authorization: Bearer sk_example_123456789"
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.connect.get_application(id: "conn_app_01HXYZ123456789ABCDEFGHIJ")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.connect.get_application(id_="conn_app_01HXYZ123456789ABCDEFGHIJ")
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Connect().GetApplication(context.Background(), "conn_app_01HXYZ123456789ABCDEFGHIJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos->connect()->getApplication(id: "conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.connect.getApplication("conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Connect.GetApplicationAsync("conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .connect()
        .get_application("conn_app_01HXYZ123456789ABCDEFGHIJ")
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "application_type": "oauth",
  "redirect_uris": [
    {
      "uri": "https://example.com/callback",
      "default": true
    }
  ],
  "uses_pkce": true,
  "is_first_party": true,
  "object": "connect_application",
  "id": "conn_app_01HXYZ123456789ABCDEFGHIJ",
  "client_id": "client_01HXYZ123456789ABCDEFGHIJ",
  "description": "An application for managing user access",
  "name": "My Application",
  "scopes": [
    "openid",
    "profile",
    "email"
  ],
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## List Connect Applications

List all Connect Applications in the current environment with optional filtering.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/connect/applications" \
  --header "Authorization: Bearer sk_example_123456789"
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.connect.list_applications
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.connect.list_applications()
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Connect().ListApplications(context.Background())
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos->connect()->listApplications();
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.connect.listApplications();
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Connect.ListApplicationsAsync();
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .connect()
        .list_applications()
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "list",
  "data": [
    {
      "application_type": "oauth",
      "redirect_uris": [
        {
          "uri": "https://example.com/callback",
          "default": true
        }
      ],
      "uses_pkce": true,
      "is_first_party": true,
      "object": "connect_application",
      "id": "conn_app_01HXYZ123456789ABCDEFGHIJ",
      "client_id": "client_01HXYZ123456789ABCDEFGHIJ",
      "description": "An application for managing user access",
      "name": "My Application",
      "scopes": [
        "openid",
        "profile",
        "email"
      ],
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "list_metadata": {
    "before": "conn_app_01HXYZ123456789ABCDEFGHIJ",
    "after": "conn_app_01HXYZ987654321KJIHGFEDCBA"
  }
}
```

:::

## Machine-to-Machine Applications

[M2M applications](https://workos.com/docs/authkit/connect/m2m) are designed for server-to-server authentication without user interaction.

:::code-group{title="M2M Application Example"}

```json language="curl"
{
  "object": "connect_application",
  "id": "app_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
  "client_id": "client_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
  "name": "Backend Service",
  "description": "Machine-to-machine application for API access",
  "application_type": "m2m",
  "organization_id": "org_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
  "scopes": ["api:read", "api:write", "api:admin"],
  "created_at": "2024-01-15T12:30:00.000Z",
  "updated_at": "2024-01-15T12:30:00.000Z"
}
```

:::

## OAuth Applications

[OAuth applications](https://workos.com/docs/authkit/connect/oauth) are designed for web, mobile, desktop, and CLI applications where a user needs to authenticate.

:::code-group{title="OAuth Application Examples"}

```json language="curl" title="First-Party" tab="1"
{
  "object": "connect_application",
  "id": "app_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
  "client_id": "client_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
  "name": "My Application",
  "description": "Application description",
  "application_type": "oauth",
  "redirect_uris": [
    {
      "uri": "https://example.com/callback",
      "default": true
    }
  ],
  "uses_pkce": false,
  "is_first_party": true,
  "scopes": ["example-permission:read", "example-permission:write"],
  "created_at": "2024-01-15T12:30:00.000Z",
  "updated_at": "2024-01-15T12:30:00.000Z"
}
```

```json language="curl" title="Third-Party" tab="2"
{
  "object": "connect_application",
  "id": "app_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
  "client_id": "client_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
  "name": "My Application",
  "description": "Application description",
  "application_type": "oauth",
  "redirect_uris": [
    {
      "uri": "https://example.com/callback",
      "default": true
    }
  ],
  "uses_pkce": false,
  "is_first_party": false,
  "was_dynamically_registered": false,
  "organization_id": "org_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
  "scopes": ["example-permission:read", "example-permission:write"],
  "created_at": "2024-01-15T12:30:00.000Z",
  "updated_at": "2024-01-15T12:30:00.000Z"
}
```

```json language="curl" title="Dynamically Registered" tab="3"
{
  "object": "connect_application",
  "id": "app_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
  "client_id": "client_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
  "name": "My Application",
  "description": "Application description",
  "application_type": "oauth",
  "redirect_uris": [
    {
      "uri": "https://example.com/callback",
      "default": true
    }
  ],
  "uses_pkce": false,
  "is_first_party": false,
  "was_dynamically_registered": true,
  "scopes": [],
  "created_at": "2024-01-15T12:30:00.000Z",
  "updated_at": "2024-01-15T12:30:00.000Z"
}
```

:::

## Update a Connect Application

Update an existing Connect Application. For OAuth applications, you can update redirect URIs. For all applications, you can update the name, description, and scopes.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request PUT \
  --url "https://api.workos.com/connect/applications/conn_app_01HXYZ123456789ABCDEFGHIJ" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "name": "My Application",
        "description": "An application for managing user access",
        "scopes": [
            "openid",
            "profile",
            "email"
        ],
        "redirect_uris": [
            {
                "uri": "https://example.com/callback",
                "default": true
            }
        ]
    }
BODY
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.connect.update_application(id: "conn_app_01HXYZ123456789ABCDEFGHIJ")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.connect.update_application(id_="conn_app_01HXYZ123456789ABCDEFGHIJ")
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Connect().UpdateApplication(context.Background(), "conn_app_01HXYZ123456789ABCDEFGHIJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos->connect()->updateApplication(id: "conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.connect.updateApplication("conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Connect.UpdateApplicationAsync("conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .connect()
        .update_application("conn_app_01HXYZ123456789ABCDEFGHIJ")
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "application_type": "oauth",
  "redirect_uris": [
    {
      "uri": "https://example.com/callback",
      "default": true
    }
  ],
  "uses_pkce": true,
  "is_first_party": true,
  "object": "connect_application",
  "id": "conn_app_01HXYZ123456789ABCDEFGHIJ",
  "client_id": "client_01HXYZ123456789ABCDEFGHIJ",
  "description": "An application for managing user access",
  "name": "My Application",
  "scopes": [
    "openid",
    "profile",
    "email"
  ],
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

### POST /connect/applications

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | Yes | Name of the application. |
| `application_type` | "oauth" \| "m2m" | Yes | Type of application - either "oauth" or "m2m". |
| `description` | string | No | Description of the application. |
| `scopes` | string[] | No | Permission slugs to assign to the application. |
| `redirect_uris` | object[] | No | Redirect URIs for the application. OAuth applications only. |
| `uses_pkce` | boolean | No | Whether the application uses PKCE (Proof Key for Code Exchange). OAuth applications only. |
| `is_first_party` | boolean | Yes | Whether this is a first-party application. Required for OAuth applications. |
| `organization_id` | string | No | The organization ID this application belongs to. Required for M2M applications. For OAuth applications, required if is_first_party is false. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `connect_application` | object | Distinguishes the connect application object. |

### DELETE /connect/applications/{id}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The application ID or client ID of the Connect Application. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `empty` | empty | Returns an empty response on success. |

### GET /connect/applications/{id}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The application ID or client ID of the Connect Application. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `connect_application` | object | Distinguishes the connect application object. |

### GET /connect/applications

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `before` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. |
| `after` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. |
| `limit` | integer | No | Upper limit on the number of objects to return, between `1` and `100`. Defaults to `10`. |
| `order` | "normal" \| "desc" \| "asc" | No | Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. |
| `registration_types` | ("dynamic" \| "authenticated")[] | No | Filter Connect Applications by registration type. Specify multiple as a comma-separated list (e.g. `registration_types=dynamic,authenticated`). Defaults to `authenticated` only when not specified. |
| `organization_id` | string | No | Filter applications by organization ID. |

### M2M Application

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `object` | "connect_application" | Yes | Always "connect_application". |
| `id` | string | Yes | Unique identifier for the application. |
| `client_id` | string | Yes | OAuth client ID for the application. |
| `name` | string | Yes | Name of the application. |
| `description` | string | No | Description of the application. |
| `application_type` | "m2m" | Yes | Type of application - either "oauth" or "m2m". |
| `organization_id` | string | Yes | The organization ID this application belongs to. First-party applications are managed by you, do not belong to an Organization, and therefore will not have an `organization_id`. |
| `scopes` | string[] | Yes | Permission slugs assigned to the application. |
| `created_at` | string | Yes | ISO 8601 timestamp of creation. |
| `updated_at` | string | Yes | ISO 8601 timestamp of last update. |

### OAuth Application

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `object` | "connect_application" | Yes | Always "connect_application". |
| `id` | string | Yes | Unique identifier for the application. |
| `client_id` | string | Yes | OAuth client ID for the application. |
| `name` | string | Yes | Name of the application. |
| `description` | string | No | Description of the application. |
| `application_type` | "oauth" | Yes | Type of application - either "oauth" or "m2m". |
| `redirect_uris` | array | Yes | Redirect URIs configured for OAuth applications. |
| `uses_pkce` | boolean | Yes | Whether the OAuth application uses PKCE (Proof Key for Code Exchange). |
| `is_first_party` | boolean | Yes | Whether this is a first-party OAuth application. This is false for third-party applications which are owned by an Organization. |
| `was_dynamically_registered` | boolean | No | Whether the OAuth application was dynamically registered. Read more about Dynamic Client Registration and MCP auth in [our guide](/authkit/mcp/integrating/enabling-client-id-metadata-document). |
| `organization_id` | string | No | The organization ID this application belongs to. First-party applications are managed by you, do not belong to an Organization, and therefore will not have an `organization_id`. |
| `scopes` | string[] | Yes | Permission slugs assigned to the application. |
| `created_at` | string | Yes | ISO 8601 timestamp of creation. |
| `updated_at` | string | Yes | ISO 8601 timestamp of last update. |

### PUT /connect/applications/{id}

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | No | Updated name of the application. |
| `description` | string | No | Updated description. Pass null to clear. |
| `scopes` | string[] | No | Updated permission slugs. |
| `redirect_uris` | object[] | No | Updated redirect URIs. OAuth applications only. |

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The application ID or client ID of the Connect Application. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `connect_application` | object | Distinguishes the connect application object. |