Register an app¶
Every integration starts with an application registered in My Apps
(https://<your LuciBook host>/developer/apps/).
Preconditions¶
Before you can create an app your LuciBook account needs:
- A verified e-mail address.
- MFA enabled on your account.
- The current Developer Platform Terms accepted.
A missing verified e-mail address shows a 403 page naming the gap rather than redirecting you; missing MFA or unaccepted Terms redirects you to the step that fixes it. There is no separate "developer account" signup.
Confidential vs public clients¶
- Confidential client — a server-side app that can keep a client secret safe (a backend service). Use the Authorization Code + PKCE flow with the secret.
- Public client — a client that cannot keep a secret (a single-page app, a mobile app, a CLI). Use Authorization Code + PKCE without a client secret; PKCE is what protects the exchange instead.
Redirect URIs¶
Redirect URI rules¶
- At most 10 redirect URIs per application, no duplicates.
https://is allowed for any client type.http://is allowed only for loopback hosts (localhost,127.0.0.1,::1), at any port.- A custom (non-http/https) scheme is allowed only for public clients (mobile/desktop apps using PKCE) — a confidential client never gets one.
- No fragment (
#...) component is allowed, ever. - No wildcard host segments (e.g.
https://*.example.com/cb). javascript:,data:,vbscript:andfile:are refused outright, even for public clients.
The redirect_uri is checked twice, with two different rules — always
send exactly the URI you registered in both places. At token exchange the
match against the authorize-time value is exact-string, byte-for-byte, with
no leniency at all. At authorize, matching against your registered URI is
scheme+host+path plus a query-superset/loopback-port allowance — see
Authorization Code + PKCE, step 4
for the exact rules.
Next step¶
Once your app is registered, walk through Authorization Code + PKCE to get your first access token.