> For the complete documentation index, see [llms.txt](https://docs.floral.fun/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.floral.fun/getting-started/create-application.md). # Create your application Everything here is self-service, with no approval step. ## 1. Activate your developer account 1. Go to [floral.fun/developers](https://floral.fun/developers). 2. Sign in with your Floral account. If you don't have one, signing in creates it, and you'll choose a username first. 3. Accept the [Developer Terms and API Policies](https://floral.fun/developers/terms), then choose **Activate Developer Account**. Your developer account uses your Floral login, so there's no separate password. ## 2. Create an application Choose **Create Application** and fill in: | Field | Required | Notes | | -------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Name | Yes | 2 to 50 characters. It can't contain a link or web address, and names that could be mistaken for Floral or for staff, such as "official" or "support", are refused | | Description | Yes | 1 to 300 characters of plain text. Shown on the consent screen | | Icon | No | PNG, JPEG or WebP, up to 2 MB. It's cropped to a 512×512 square and checked by image moderation | | Website | No | https | | Privacy policy, terms of service | Yes | https. Linked from the consent screen | | Support contact | Yes | An email address or https URL | | Application type | Yes | See below. It can't be changed later | | Redirect URLs | Yes | 1 to 10 | | Permissions | Yes | At least one of the [scopes](/authentication/scopes-and-tokens.md) | Names and descriptions are moderated. You can have up to 10 applications, and deleting one frees its place. ## Choose an application type | | Confidential | Public | | ------------- | -------------- | -------------------------- | | Runs | On your server | In a browser or mobile app | | Client secret | Yes | No | | PKCE | Required | Required | | App tokens | Yes | No | Choose confidential if you have a backend. Anything shipped to a browser or a phone can be read by its users, so a public client must never contain a secret. ## Configure redirect URLs Redirect URLs match exactly, including the path, query and any trailing slash. * **Allowed:** `https://yourapp.example/callback`, and for development `http://localhost:3000/callback` or `http://127.0.0.1:3000/callback` * **Not allowed:** wildcards, plain `http` on other hosts, custom schemes such as `yourapp://`, fragments and embedded credentials For a mobile app, use an https universal link or app link as the redirect URL, and open the authorization page in the system browser rather than an embedded web view. ## Save your credentials Your **client ID** (`flr_client_...`) is public. A confidential client's **client secret** (`flr_secret_...`) is shown once, when it's created or rotated, because Floral stores only a hash of it. Copy it straight away and keep it on your server. | Action | What happens | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Rotate secret** | The new secret works at once. The old one and any app tokens stop working immediately. User access tokens keep working, and refreshing them needs the new secret | | **Revoke secret** | `/oauth/token` and `/oauth/revoke` return `invalid_client` until you generate a new one. App tokens stop working. User access tokens keep working until they expire | ## Test and manage your application Connect your own Floral account by following the [Quickstart](/getting-started/quickstart.md). Your application's page in the Developer Portal shows: * Authorized users and active connections * API requests, failed requests and rate-limited requests for the last 30 days. These counts are close rather than exact * Credential dates and recent changes From the same page you can also: | Action | What happens | | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | **Disable** | New connections and token requests are refused, and every token stops working. Users stay connected | | **Re-enable** | Connections work again. Earlier tokens stay revoked, so get a new app token, and send users through Floral Connect to get new user tokens | | **Revoke all authorizations** | Every user is disconnected and must approve your application again | | **Delete** | The client ID, credentials and connections end permanently. This can't be undone | Revoking all authorizations and deleting ask you to type the application's name. ## Limits on changes | Change | Limit per hour | | ----------------- | -------------- | | New applications | 5 | | Application edits | 60 | | Icon uploads | 20 | | Secret changes | 10 | ## Protection for new devices To protect you from a stolen login, a device that signed in within the last 24 hours can't change redirect URLs, permissions, links or support contact, change secrets, re-enable, revoke authorizations or delete an established application. Confirm with your authenticator app, or use a device you've used before. Name, description and icon edits, disabling, and setting up an application you made on that device with nobody connected all work straight away. ## When Floral stops an application An application stops working if Floral suspends it or its developer account, or if the owner's Floral account is deactivated or deleted. Token requests then return `invalid_client`, and API calls return `invalid_token`. If the Developer Terms change, you'll be asked to accept them again before you can make changes. Your applications keep working in the meantime. ## Verification badge New applications show as a third-party application that Floral hasn't verified. They work normally. To ask about verification, email . --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.floral.fun/getting-started/create-application.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.