Dashboard setup

Everything on this page happens in your 36Blocks dashboard, inside your Block's settings. Nothing here requires writing any code yet. The same actions are available through the OAuth Clients and Custom Scopes endpoints in the Blocks module.

#

Create an OAuth Config

  1. Open your Block.

  2. Go to the OAuth section.

  3. Click Add OAuth.

  4. Fill in the form:

Field Notes
Name Shown to your users on the consent screen as the name of the app requesting access.
Client type Confidential or Public. See OAuth 2.0 Integration Overview if you're unsure which fits. This cannot be changed after the config is created; if you pick wrong, delete and recreate it.
Require PKCE A toggle. Always on and locked for public clients (PKCE is mandatory for them). Optional for confidential clients; turn it on if you want an extra layer of protection even though the client can hold a secret.
Allowed scopes Pick every scope this integration is allowed to request: profile, email, and/or any custom scopes your Block has defined. You can create a new custom scope from this dropdown with its Create scope button, without leaving the dialog. A connecting app can never request a scope outside this list; it will be rejected if it tries.
Redirect URIs Type a redirect URI and press Enter (or separate with commas) to add it as a chip; add as many as you need. The third-party app must send back exactly one of these (character for character) on every request. There is no partial or wildcard matching.

  1. Click Add OAuth.

  2. A dialog shows your new Client ID and, for confidential clients only, a Client secret. Copy the secret now: it is shown exactly once and cannot be retrieved again. If you lose it, use Regenerate secret from the config's menu. This immediately invalidates the old secret, with no overlap period, so coordinate with whoever is using it on the other end before you regenerate.

Public clients don't get a secret at all. They authenticate using PKCE instead (see Consent screen).

#

Managing an existing config

From the ⋮ menu on any row in the OAuth list you can:

  • Edit: change the name, PKCE requirement, allowed scopes, or redirect URIs. Client type can't be edited here either.

  • Regenerate secret (confidential clients only).

  • Disable / Enable: disabling immediately revokes every active connection made through this config. Any app that had already connected loses access right away, and has to go through consent again once you re-enable it. Enabling just allows new connections again; it does not restore anything that was revoked while disabled.

  • Delete: removes the config from your list. It does not revoke existing connections by itself; disable it first if you also want to cut off access that has already been granted.

#

Create a custom scope

Only needed if profile and email aren't enough and you want to gate your own, product-specific data behind OAuth.

  1. Open your Block.

  2. Go to the Scope section (next to OAuth).

  3. Click Add Scope.

  4. Fill in the form:

Field Notes
Key The opaque string a connecting app will request (for example tickets:read) and that will show up in the token's granted-scopes list. Lowercase letters, numbers, and underscores only, with optional colon-separated segments. To 36Blocks this is purely a string: your own backend decides what having this scope actually permits. (profile and email are built in and already understood by the Get OAuth User Info endpoint.) The key can't be changed after creation; delete and recreate it if you need a different one.
Label The human-readable sentence shown on the consent screen, for example "Read your tickets". Can be edited any time.
  1. Click Add Scope.

A custom scope is defined once per Block, not per OAuth Config. Once created, it's available to pick from the Allowed scopes list on any OAuth Config belonging to that same Block.