crowdin · rohalskyy · Aug 20, 2026
@@ -23,7 +23,6 @@ import twoFactorAuthenticationRecoveryCodes from '!/crowdin/getting-started/acco
 import sessions from '!/crowdin/getting-started/account/account_settings_sessions.png';
 import tokens from '!/crowdin/getting-started/account/account_settings_tokens.png';
 import sudoModeConfirmingCredentials from '!/crowdin/getting-started/account/sudo_mode_confirming_credentials.png';
-import oauthAppsNewApp from '!/crowdin/getting-started/account/oauth_apps_new_app.png';
 import ratesSettings from '!/crowdin/getting-started/account/account_settings_rates.png';
 
 Manage your Crowdin account settings, including profile details, notification preferences, security settings, and more using the **Account Settings** page. To access it, click on your profile picture in the upper-right corner and select **Settings**.
@@ -426,12 +425,13 @@ To add a new application, follow these steps:
 
 <Steps>
   1. In the upper-right corner, click on your profile picture and select **Settings**.
-  1. Switch to the **OAuth** tab and click **New Application**.
-  1. In the appeared dialog, specify the following information:
-     * **Name** and **Description** &ndash; (optional) will be displayed to users when they authorize the app to access their Crowdin accounts.
-     * **Authorization callback URLs** &ndash; the URLs to which users will be sent after they authorize with Crowdin. You can add multiple URLs separated by commas (no need to use quotes).
+  2. Switch to the **OAuth** tab and click **New Application**.
+  3. In the dialog that opens, specify the following information:
+     * **Name** and **Description**: (Optional) Will be displayed to users when they authorize the app to access their Crowdin accounts.
+     * **Authorization callback URLs**: The URLs to which users will be sent after they authorize with Crowdin. You can add multiple URLs separated by commas (no need to use quotes).
+     * **Confidential**: Selected by default. Keep it selected when a trusted backend can store the client secret. Clear it for single-page (SPA), mobile, and CLI apps, which authorize with PKCE and have no client secret.
      * Select the access your app needs from the list of available [Scopes](/developer/understanding-scopes/).
-  1. Click **Create**. <Image src={oauthAppsNewApp} alt="Create OAuth App" class="width-md crowdin-modal" />
+  4. Click **Create**.
 </Steps>
 
 <Aside>
@@ -440,18 +440,22 @@ To add a new application, follow these steps:
 
 ### Modifying an OAuth App
 
-After you create an OAuth application, you can make changes to it. Go to your account's **Settings > OAuth Applications** to see the list of OAuth apps created under your account, the dates the apps were created, and how many users are using each app.
+After you create an OAuth application, you can make changes to it. Go to your account's **Settings > OAuth** to see the list of OAuth apps created under your account, the dates the apps were created, and how many users are using each app.
 
 To find a specific application, type its name or Client ID in the search field at the top of the list.
 
 Click <Icon name="mdi:dots-horizontal" class="inline-icon" /> in the *Actions* column on the necessary app to open the context menu.
 
 Using the available options, you can do the following:
 
-* **Edit** &ndash; update the application name, description, URLs, and scopes. Access Client ID and Client Secret of the created application.
-* **Reset secret** &ndash; Reset the Client Secret for the app.
-* **Revoke tokens** &ndash; Revoke all user tokens.
-* **Delete** &ndash; Delete the application.
+* **Edit**: Update the application name, description, URLs, scopes, and client type. Access Client ID and Client Secret of the created application.
+* **Reset secret**: Generate a new Client Secret for the app.
+* **Revoke tokens**: Revoke all user tokens.
+* **Delete**: Delete the application.
+
+Switching an application between confidential and public changes how it authorizes, so Crowdin asks you to confirm. Making an application public permanently deletes its client secret and switches it to PKCE. Making it confidential generates a new client secret. In both cases, all active tokens are revoked, so users must authorize the application again.
+
+OAuth applications used by a Crowdin App authorize with a client secret, so their client type stays confidential.
 
 ### Managing Connected OAuth Applications
 

@@ -13,6 +13,8 @@ You can enable organization members to authorize your OAuth app.
 
 When you build an OAuth app, implement the web application flow described below to obtain an authorization code and then exchange it for a token.
 
+You choose the application type when you register it. A confidential application authorizes with a client secret, which suits apps with a trusted backend that can keep the secret private. A public application authorizes with PKCE and has no client secret, which suits single-page (SPA), mobile, and CLI apps.
+
 ## Request Authorization Code
 
 You should redirect the user to the `/oauth/authorize` endpoint with the following GET parameters:
@@ -24,7 +26,7 @@ https://accounts.crowdin.com/oauth/authorize
 This will ask the user to approve the app access to their account based on the scopes specified in `REQUESTED_SCOPES` and then redirect back to the `REDIRECT_URI` you provided when creating an app.
 
 <Aside type="tip">
-  For enhanced security, we strongly recommend using the Proof Key for Code Exchange (PKCE) extension for a more secure token exchange.
+  Public applications must use the Proof Key for Code Exchange (PKCE) extension, and confidential applications should use it too.
 </Aside>
 
 ### Parameters {#request-authorization-code-parameters}
@@ -66,12 +68,12 @@ This will ask the user to approve the app access to their account based on the s
   <tr>
     <td><code>code_challenge</code></td>
     <td>string</td>
-    <td><strong>Strongly recommended.</strong> A Base64-URL-encoded SHA-256 hash of the <code>code_verifier</code>. Used to secure the authorization flow with PKCE. Required if <code>code_challenge_method</code> is provided. Read more about [PKCE RFC](https://datatracker.ietf.org/doc/html/rfc7636).</td>
+    <td><strong>Required for public applications</strong>, strongly recommended for confidential ones. A Base64-URL-encoded SHA-256 hash of the <code>code_verifier</code>. Used to secure the authorization flow with PKCE. A public application that omits it receives an <code>invalid_request</code> error instead of an authorization code. Read more about [PKCE RFC](https://datatracker.ietf.org/doc/html/rfc7636).</td>
   </tr>
-    <tr>
+  <tr>
     <td><code class="whitespace-nowrap">code_challenge_method</code></td>
     <td>string</td>
-    <td><strong>Strongly recommended.</strong> The method used to derive the <code>code_challenge</code>. Crowdin supports <code>S256</code> and <code>plain</code>. Required if <code>code_challenge</code> is provided.</td>
+    <td><strong>Strongly recommended.</strong> The method used to derive the <code>code_challenge</code>. Crowdin supports <code>S256</code> and <code>plain</code>. Send <code>S256</code>. When this parameter is omitted, the method defaults to <code>plain</code>, which transmits the verifier unhashed.</td>
   </tr>
   </tbody>
 </table>
@@ -94,7 +96,7 @@ If authorization has been declined, users are redirected to your website with an
 https://impact-mobile.com/auth/crowdin/?error=access_denied&state=d131dd02c5e6eec4
 ```
 
-## Users Are Redirected Back to Your Site by Crowdin
+## Exchange the Code for an Access Token
 
 If a user authorizes the app, Crowdin redirects back to your site and you can exchange the code received for an access token:
 
@@ -126,22 +128,22 @@ POST https://accounts.crowdin.com/oauth/token
   <tr>
     <td><code>client_secret</code></td>
     <td>string</td>
-    <td><strong>Required.</strong> You receive Client Secret for the app when you register it. This parameter is not required if you're using PKCE (i.e., providing a <code>code_verifier</code>).</td>
+    <td><strong>Required for confidential applications.</strong> You receive Client Secret for the app when you register it. Sending a <code>code_verifier</code> does not replace it. Public applications have no client secret and omit this parameter.</td>
   </tr>
   <tr>
     <td><code>redirect_uri</code></td>
     <td>string</td>
-    <td><strong>Required.</strong> The URL in your application where users will be sent after authorization. </td>
+    <td><strong>Required.</strong> The URL in your application where users will be sent after authorization.</td>
   </tr>
   <tr>
     <td><code>code</code></td>
     <td>string</td>
-    <td><strong>Required.</strong> Code received from the callback query string. </td>
+    <td><strong>Required.</strong> Code received from the callback query string.</td>
   </tr>
   <tr>
     <td><code>code_verifier</code></td>
     <td>string</td>
-    <td><strong>Strongly recommended.</strong> The original random string used to generate the <code>code_challenge</code>. Required if a <code>code_challenge</code> was sent in the initial authorization request.</td>
+    <td><strong>Required if the authorization request included a <code>code_challenge</code>.</strong> The original random string used to generate the <code>code_challenge</code>. Both confidential and public applications send it.</td>
   </tr>
   </tbody>
 </table>
@@ -232,7 +234,7 @@ POST https://accounts.crowdin.com/oauth/token
   <tr>
     <td><code>client_secret</code></td>
     <td>string</td>
-    <td><strong>Required.</strong> You receive Client Secret for the app when you register it.</td>
+    <td><strong>Required for confidential applications.</strong> You receive Client Secret for the app when you register it. Public applications omit this parameter.</td>
   </tr>
   <tr>
     <td><code>refresh_token</code></td>

@@ -220,9 +220,10 @@ To add an OAuth app, follow these steps:
 <Steps>
   1. Click on your profile picture in the upper-right corner and select **Organization Settings**.
   2. Switch to the **OAuth apps** section on the left sidebar and click **New App**.
-  3. On the *Create application* page, enter the following information:
+  3. On the **Create application** page, enter the following information:
       * **Application name** and **Application description** (optional) will be shown to users when they authorize the app with access to their Crowdin Enterprise accounts.
       * **Authorization callback URLs** are the URLs where users will be sent after they authorize with Crowdin Enterprise. You can add multiple URLs separated by a comma (no need to use quotation marks).
+      * **Confidential** is selected by default. Keep it selected when a trusted backend can store the client secret. Clear it for single-page (SPA), mobile, and CLI apps, which authorize with PKCE and have no client secret.
       * Select the access your app requires from the list of [Scopes](/developer/understanding-scopes/) available.
   4. Click **Create Application**.
 </Steps>
@@ -237,15 +238,20 @@ After creating an OAuth application, organization admins can make changes to it.
 
 To find a specific application, type its name or Client ID in the search field at the top of the list.
 
-Click the necessary app to be able to:
+Click the necessary app, or click **Edit** in its row, to be able to:
 
-* Update the application name, description, URLs, and scopes.
+* Update the application name, description, URLs, scopes, and client type.
 * Delete the application.
 * Check how many organization users are using the app.
+* Check the client type: **Confidential** or **Public (PKCE, no secret)**.
 * Access Client ID and Client Secret of the created application.
 * Reset Client Secret for the app.
 * Revoke all user tokens.
 
+Switching an application between confidential and public changes how it authorizes, so Crowdin Enterprise asks you to confirm. Making an application public permanently deletes its client secret and switches it to PKCE. Making it confidential generates a new client secret. In both cases, all active tokens are revoked, so users must authorize the application again.
+
+OAuth applications used by a Crowdin App authorize with a client secret, so their client type stays confidential.
+
 ## Security Log
 
 Track important events that happen on the organizational level. Security log includes events such as logins, passwords, usernames, and email changes, etc. Click on the needed event to see the following details: Event type, Location, IP, Device, and Date. Use filters to find specific event types and users.

@@ -23,7 +23,6 @@ import twoFactorAuthenticationRecoveryCodes from '!/crowdin/getting-started/acco
 import sessions from '!/crowdin/getting-started/account/account_settings_sessions.png';
 import tokens from '!/crowdin/getting-started/account/account_settings_tokens.png';
 import sudoModeConfirmingCredentials from '!/crowdin/getting-started/account/sudo_mode_confirming_credentials.png';
-import oauthAppsNewApp from '!/crowdin/getting-started/account/oauth_apps_new_app.png';
 import ratesSettings from '!/crowdin/getting-started/account/account_settings_rates.png';
 
 **Hesap Ayarları** sayfasını kullanarak profil ayrıntıları, bildirim tercihleri, güvenlik ayarları ve daha fazlasını içeren Crowdin hesap ayarlarınızı yönetin. Buna erişmek için sağ üst köşedeki profil resminize tıklayın ve **Ayarlar**’ı seçin.
@@ -431,7 +430,7 @@ Yeni bir uygulama eklemek için şu adımları izleyin:
      * **Ad** ve **Açıklama** &ndash; (isteğe bağlı) uygulamaya Crowdin hesaplarına erişim yetkisi verdiklerinde kullanıcılara gösterilecektir.
      * **Yetkilendirme geri çağırma URL’leri** &ndash; Crowdin ile yetkilendirildikten sonra kullanıcılara gönderilecek URL’ler. Virgüllerle ayrılmış birden çok URL ekleyebilirsiniz (tırnak işaretlerini kullanmaya gerek yoktur).
      * Mevcut [Kapsamlar](/developer/understanding-scopes/) listesinden uygulamanızın ihtiyaç duyduğu erişimi seçin.
-  4. **Oluştur**’a tıklayın. <Image src={oauthAppsNewApp} alt="OAuth Uygulaması oluşturun" class="width-md crowdin-modal" />
+  4. **Oluştur**’a tıklayın.
 </Steps>
 
 <Aside>

@@ -23,7 +23,6 @@ import twoFactorAuthenticationRecoveryCodes from '!/crowdin/getting-started/acco
 import sessions from '!/crowdin/getting-started/account/account_settings_sessions.png';
 import tokens from '!/crowdin/getting-started/account/account_settings_tokens.png';
 import sudoModeConfirmingCredentials from '!/crowdin/getting-started/account/sudo_mode_confirming_credentials.png';
-import oauthAppsNewApp from '!/crowdin/getting-started/account/oauth_apps_new_app.png';
 import ratesSettings from '!/crowdin/getting-started/account/account_settings_rates.png';
 
 使用**账户设置**页面管理您的 Crowdin 账户设置，包括个人资料详情、通知偏好、安全设置等。 要访问它，请点击右上角的个人头像，然后选择**设置**。
@@ -427,7 +426,7 @@ Crowdin 商店提供各种应用程序，您可以安装这些应用程序来扩
      * **名称**和**描述** &ndash;（可选）将在用户授权应用程序访问其 Crowdin 账户时向他们显示。
      * **授权回调 URL** &ndash; 用户使用 Crowdin 授权后将被发送到的 URL。 您可以添加多个 URL，以逗号分隔（无需使用引号）。
      * 从可用的[范围](/zh/developer/understanding-scopes/)列表中选择您的应用所需的访问权限。
-  4. 单击 **创建**。 <Image src={oauthAppsNewApp} alt="创建 OAuth 应用" class="width-md crowdin-modal" />
+  4. 单击 **创建**。
 </Steps>
 
 <Aside>