Client applications

What are client applications? 

Client applications provide a secure, machine-to-machine access mechanism for SheerID services. They leverage the "OAuth Client Credentials Flow" to retrieve a JSON Web Token (JWT), which is then used for authentication and authorization across our various APIs. You can refer to the Auth0 documentation for a deeper dive into the OAuth Client Credentials Flow.

Static Access Token support ends January 31, 2027

Client applications are replacing static Access Tokens in order to improve security and flexibility.

Transition timeline:

• Aug. 1, 2026: You will no longer be able to create NEW static tokens
• Existing tokens remain active: All currently active static tokens will continue to work normally through Jan. 31, 2027
• Jan. 31, 2027: Final deprecation date; all integrations must be migrated to client applications by this date

Please have your team migrate active workflows before the deadline to avoid disruptions. If you need technical assistance during this transition, reach out to our Product Support team.

How to create a client application

Developer users (API Access permission) can easily create and manage client applications directly within MySheerID. However, they cannot assign or un-assign roles for a client application unless they also have the User Admin permission. 

1. Log in to your MySheerID account, then navigate to the account menu located in the bottom left corner
2. Select Access Management from the menu.
3. A new Applications area will appear where you can create and edit your client applications. Please note that the Secret Token associated with the account information section is only visible to the account owner. Each client application will have its own Client Secret token.

4. Click on the +Add button to create a new record

   

5. To create a new application, the following fields are required:
   1. Name

   2. Role(s) – learn more about these user roles

      

6. Once you have created your application(s), you will see them listed in the Applications section. You can toggle the dropdown menu to view more details about each application

   

7. With the section expanded, you can edit or delete the application

   

8. You will additionally be able to rotate, reveal, and copy the Client Secret, the token associated with the created application

Generating a JWT

Now that you have client applications, you are ready to start generating JWTs. For information on how to generate the JWT, click here.

Rotating a Client Secret

The client secret acts as the secure reference to authenticate your application is trusted, similar to a password for a user login. Just like a password, there are times when changing the client secret is recommended, such as:

1. Rotating periodically to maintain security
2. A Client Secret was found to be exposed publicly

For these cases, each application provides a button to rotate the client secret. This will generate a new value that should be used when generating an access token with the client application. By default, any existing authentication tokens created with the application will continue to function until they expire. This allows any integrations using the application to update to the new secret without any downtime.

When rotating a client secret, you will be prompted to confirm the action since it cannot be undone.

In the case a client secret has been compromised, an option is provided to immediately invalidate all access tokens associated with that client application to prevent any further action. Using this option will break any existing integrations relying on the application, so use with caution.

For more information about the technology behind SheerID's client applications, check out the official Okta Auth0 documentation here.

You can also find further details in our Developer Center.