A client application is an OAuth/OIDC application registered in a user pool. It issues an ID Token to users authenticated through SSO. An AI Agent application exchanges the ID Token with Agent Identity for a Workload Access Token to complete inbound identity authentication. This topic describes how to create and delete client applications.
Client application overview
A client application identifies an AI Agent application registered in a user pool. It performs the following functions in the inbound identity authentication process:
Issue ID Tokens: After a user is authenticated by using the SSO identity provider of the user pool, the client application issues an ID Token that contains claims such as the user's identity and assigned roles.
Support credential exchange: The AI Agent application uses the ID Token issued by the client application to request a Workload Access Token from the inbound identity provider of Agent Identity.
After each client application is created, a unique Client ID and Client Secret are generated. The AI Agent application uses these credentials to interact with the user pool.
Create a client application
Create an OAuth/OIDC client for your AI Agent application.
Log on to the Agent Identity console.
In the left-side navigation pane, choose .
Click the name of the desired user pool to go to the user pool details page.
Click the Clients tab.
Click Create Client.
On the Create Client page, enter a client name and an optional description, and then click Create Client.
After the client application is created, the system generates the following credentials:
Client ID: The unique identifier of the client application.
Client Secret: The secret key of the client application, which is used for authentication.
The Client Secret is displayed only once when the client application is created. Store it securely. If you lose it, you must create another client application.
View a client application
You can view the basic information and configuration of a client application.
In the client list, click the name of the desired client.
On the client details page, view the following information:
Client Name: The name of the client application.
Client ID: The unique identifier of the client application.
Redirect URI: The redirect URI in the OAuth authorization flow.
OAuth scopes: The OAuth scopes of the client application, including OpenID Connect authentication and AI Agent invocation permissions.
Delete a client application
You can delete a client application that is no longer in use.
After a client application is deleted, AI Agent applications that use its Client ID and Client Secret can no longer obtain ID Tokens, and the inbound identity authentication process is interrupted. This operation cannot be undone.
In the client list, find the desired client. In the Actions column, click Delete.
In the confirmation dialog box, click OK.
Integration guide
After you create a client application, complete the following integration in your AI Agent application:
Use the user pool's Sign-in URL as the SSO sign-in entry for users.
After a user completes SSO sign-in, use the Client ID and Client Secret to request an ID Token from the token endpoint of the user pool.
Use the obtained ID Token to exchange for a Workload Access Token from the inbound identity provider of Agent Identity.
For the complete process of obtaining credentials, see Obtain credentials.