> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://docs.prividium.com/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

Applications represent OAuth clients that enable user authentication through OIDC flows. Each application receives a
unique OAuth Client ID and defines redirect URIs for the authentication callback. Public applications appear in the User
Panel, allowing users to discover and navigate to them.

## Overview

* **OAuth Client ID**: A unique identifier assigned automatically when you create an application.
* **Redirect URIs**: Callback URLs your application sends users to after authentication. Must match exactly.
* **Whitelisted Origin**: The CORS origin allowed for browser-based requests from your application.
* **Public vs Private**: Public applications appear in the User Panel for user discovery.
* **Perpetual Applications**: System-created applications marked with a shield icon. These cannot be edited or deleted.

## Manage Applications

### 1. Open the Applications page

1. Go to the **Admin Dashboard**.
2. Select **User Apps** from the sidebar.
3. Review the list of applications with their names, visibility, OAuth Client IDs, and redirect URIs.

### 2. Create an application

1. Click **New application**.
2. Fill in the application details:
   * **Name** (required): A display name for the application.
   * **Whitelisted Origin**: The allowed CORS origin (e.g., `https://myapp.example.com`). Do not include paths or
     trailing slashes.
   * **Public Application**: Enable to make the application visible in the User Panel.
   * **Description**: A brief summary of the application (maximum 200 characters).
   * **Image URL**: A URL to the application icon, displayed on the User Panel card.
   * **Redirect URIs** (required): One or more OAuth callback URLs. Click **Add Redirect URI** to add additional
     entries.
3. Click **Save**.

The system assigns an **OAuth Client ID** automatically upon creation. For instructions on integrating this ID into your
web application, see
[Building Web Applications](/developers/applications/building-web-applications#1-register-oauth-client).

### 3. Edit an application

1. Click the application row in the list.
2. Modify any fields as needed.
3. Click **Save**.

:::info[IMPORTANT]
Changing the **Whitelisted Origin** or the **Redirect URIs** may take up to the configured cache duration to propagate
(default: 1 minute, controlled by `CORS_CACHE_DURATION_MS`). When running multiple `permissions-api` instances the cache
is not shared between them, so propagation can take up to the full cache duration in that setup. Plan these changes
during low-traffic periods when possible.
:::

The edit view also displays read-only metadata: **Id**, **OAuth Client Id**, **Created At**, and **Last Updated At**.

### 4. Delete an application

1. Open the application by clicking its row.
2. Click **Delete**.
3. Confirm the deletion.

:::info[IMPORTANT]
Deleting an application prevents all future user logins through its OAuth flow and revokes every session that was
issued to it. Users' own sessions in the User Panel are not affected. This action cannot be undone.
:::

## Application Sessions

When a user signs in to an application, the User Panel issues a session bound to that application's OAuth Client ID
instead of handing over the user's own session. The Permissions API accepts it only on the endpoints an application
needs (RPC, profile, wallets, contract ABI, session lifecycle); admin and account-management endpoints reject it. Users
see these sessions, labelled with the client id, on their **Sessions** page and can revoke them individually.

The admin panel and the Swagger docs are the exceptions and keep receiving the user's own session. See
[Security Limitations](/developers/applications/security-limitations#6-application-tokens-carry-the-users-rpc-authority)
for what an application token can still do.

## Perpetual Applications

Perpetual applications are system-created entries that support core platform functionality. They appear in the
applications list with a shield icon and have the following restrictions:

* All fields display as **read-only** -- you cannot modify any settings.
* The **Delete** action is not available.

These applications ensure critical authentication flows remain intact and cannot be accidentally removed or
misconfigured.