End-to-end guide for creating OAuth apps, managing clients, handling consent, and validating tokens with Wacht.

OAuth Apps for SaaS

If your SaaS needs third-party integrations or protected API resources, OAuth apps should be treated as first-class product infrastructure.

This guide set covers the full lifecycle:

Recommended rollout model

Start with Console to define app, clients, and scopes.
Automate app/client lifecycle through SDK OAuth operations.
Use gateway authorization checks in your resource server (gateway.checkPrincipalAuthz in Node, gateway().check_authz_with_principal_type in Rust).
Add operational controls for secret rotation and grant revocation.

Two redirects exist in this OAuth flow:

Consent UI redirect (platform-managed) The runtime /oauth/authorize flow redirects to /oauth/consent/init, which redirects users to https://<deployment.frontend_host>/oauth/consent. This path is platform-defined and is not client-configurable.
OAuth callback redirect (client-controlled) After approve/deny, Wacht redirects back to the OAuth client redirect_uri. This is controlled by the client registration (redirect_uris) and must match an allowlisted URI exactly.

So the consent UI route is fixed by deployment frontend host, but the final callback target is controlled by each OAuth client.

From Console or backend management APIs:

OAuth app: slug, name, description, logo, supported_scopes, scope_definitions, allow_dynamic_client_registration, is_active.
OAuth app domain/FQDN: set at creation time (production requires explicit FQDN; non-production gets an auto-generated domain).
OAuth client: client_auth_method, grant_types, redirect_uris, metadata fields (client_name, client_uri, logo_uri, tos_uri, policy_uri, contacts, software_id, software_version), key material (jwks_uri, jwks, public_key_pem), token_endpoint_auth_signing_alg.
OAuth client lifecycle: deactivate, rotate secret.
OAuth grants: list per client and revoke.

GET /oauth/authorize
POST /oauth/token
POST /oauth/revoke
POST /oauth/introspect
POST /oauth/register and GET|PUT|DELETE /oauth/register/{client_id} (when dynamic registration is enabled)
GET /.well-known/oauth-authorization-server
GET /.well-known/oauth-protected-resource