Client management

All three endpoints require a bearer token and operate only on clients owned by the signed-in account. Each account may hold up to 10 clients.

List clients

GET/api-gateway/v1/oauth/clients

{
  "status": "SUCCESS",
  "data": {
    "clients": [
      {
        "name": "My Pool App",
        "client_id": "sm_ab3de5fg7h_my-pool-app",
        "client_secret": "sm_secret_0123456789abcdef0123456789abcdef",
        "allowed_redirect_uris": ["https://app.example.com/oauth/callback"]
      }
    ],
    "current_count": 1,
    "max_count": 10
  }
}

The secret is included in the listing, so this endpoint must only be called from a trusted backend.

Create a client

POST/api-gateway/v1/oauth/clients

{ "name": "My Pool App", "allowed_redirect_uris": ["https://app.example.com/oauth/callback"] }

Returns 201 with the new client under data.client plus the updated counts. See Register an OAuth client for the full walk-through and validation rules.

client_id is derived from your account and the client name, lower-cased with non-alphanumeric runs replaced by -; a short random suffix is appended if that identifier is already taken. client_secret is generated by SplashMe and shown once.

Delete a client

DELETE/api-gateway/v1/oauth/clients/{clientId}

{ "status": "SUCCESS", "data": { "deleted_client_id": "sm_ab3de5fg7h_my-pool-app", "current_count": 0, "max_count": 10 } }

Deleting a client stops new authorizations and refreshes immediately. Access tokens already issued remain valid until they expire.

Status	message
400	client not found (including clients owned by another account)
401	User not found