---
title: "Creating apps"
description: "Create an app with a static token or an OAuth app in the backend module API Hub, step by step."
canonical: creating-apps.html
---

<a id="creating-apps"></a>

# Creating apps

- [Creating a static token app](#creating-a-static-token-app)
- [Creating an OAuth app](#creating-an-oauth-app)

<a id="administration-static-token"></a>

<a id="creating-a-static-token-app"></a>

## Creating a static token app

1. **Create a new app**
   Open Administration \> Integrations \> API Hub and click
   Create new app.
2. **Choose the type and the name**
   Select the app type Static token and enter a name.
3. **Select the scopes**
   Select the scopes that the app can use.
4. **Select the backend user**
   Select the backend user the app acts on behalf of.

   > [!TIP]
   > Select a user with only the permissions that the app needs.
5. **Generate the token**
   Click Generate secret token next to the field
   Secret. A dialog shows the bearer token for the app.

   > [!WARNING]
   > Copy the token now. The backend cannot show it again.
6. **Save the app**
   Click Save. The token becomes valid when you save the
   app.

The token is valid while the app is enabled and has the same secret. To
stop a token, generate a new secret and save the app. Changes of the
selected scopes apply to existing tokens immediately.

<a id="administration-oauth"></a>

<a id="creating-an-oauth-app"></a>

## Creating an OAuth app

1. **Create a new app**
   Open Administration \> Integrations \> API Hub and click
   Create new app.
2. **Choose the type and the name**
   Select the app type OAuth and enter a name.
3. **Select the scopes**
   Select the scopes that the app can request.
4. **Generate the client secret**
   Click Generate secret token next to the field
   Secret. A dialog shows the client secret.

   > [!WARNING]
   > Copy the secret now. The backend cannot show it again.
5. **Enter the redirect URI**
   Enter the redirect URI of the app.
6. **Save the app**
   Click Save. The client secret becomes valid when you save
   the app.

Configure the application with the value of Identifier as
client ID, the generated client secret and the endpoints described in
[OAuth 2.0](../usage/authentication.md#usage-oauth).

A backend user can only approve scopes that are selected in the app record
and that are available to that user. If you remove a scope from the app
record, issued access tokens lose this scope on the next request.

> [!NOTE]
> A new client secret does not stop issued access tokens. They stay valid
> until they expire after one hour. To stop an OAuth app immediately,
> disable it.