> For the complete documentation index, see [llms.txt](https://docs.blitzware.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blitzware.xyz/getting-started/oauth-application.md).

# Quickstart: OAuth Application

Create an OAuth Application and complete redirect-based authentication.

An OAuth Application is the right model when Users should authenticate through a redirect flow and your app should receive OAuth Tokens. Use it for SPAs, web apps, mobile apps, and backend APIs that need OAuth 2.0 authorization flows.

For the decision model, start with [Choosing Between OAuth and Basic Applications](/core-platform/choosing-between-oauth-and-basic.md).

## 1. Create the Application

In the dashboard, create an **OAuth Application** and choose the client type that matches your app:

| Client type         | Use it for                                               |
| ------------------- | -------------------------------------------------------- |
| Single Page Web App | React, Vue, Angular, or browser-only apps.               |
| Traditional Web App | Server-rendered apps that can keep secrets server-side.  |
| Native/Mobile App   | iOS, Android, desktop, and custom-scheme callback flows. |
| Backend/API         | APIs that validate access Tokens issued to clients.      |

## 2. Configure Redirect URIs

Add every allowed callback URI before testing. BlitzWare only sends authorization responses to registered Redirect URIs.

```
https://app.example.com/auth/callback
https://staging.example.com/auth/callback
mycompany://auth/callback
```

Use exact Redirect URIs per environment. See [Redirect URIs](/applications/redirect-uris.md).

{% hint style="warning" %}
Do not use broad wildcard redirects in production. Redirect URI checks are one of the main controls that prevent authorization code theft.
{% endhint %}

## 3. Use Authorization Code with PKCE

Public clients should use Authorization Code with PKCE. PKCE binds the authorization response to the client that started the flow and is required for SPA and mobile-style integrations.

{% hint style="info" %}
The token response flow is still supported for compatibility. Prefer Authorization Code with PKCE for new SPA and mobile integrations because it reduces Token exposure in browser history, logs, and intermediary tooling.
{% endhint %}

The detailed SDK guides live in the OAuth docs:

* [React SPA](https://docs.blitzware.xyz/oauth/quickstart/spa/react)
* [Vue SPA](https://docs.blitzware.xyz/oauth/quickstart/spa/vue)
* [React Native](https://docs.blitzware.xyz/oauth/quickstart/native/react-native)
* [Node.js web app](https://docs.blitzware.xyz/oauth/quickstart/webapp/node)

## 4. Handle Tokens and Session state

After the redirect completes, your app receives or exchanges for tokens depending on the SDK and client type. Treat tokens as credentials:

* Keep access Tokens short-lived.
* Use refresh Tokens only when the Application is configured for them.
* Store tokens in secure, client-appropriate storage.
* Revoke tokens when the User signs out or risk changes.

Read [Sessions and Tokens](/core-platform/sessions-and-tokens.md) and [Session Revocation](/operations/session-revocation.md).

## Next steps

* Choose an identity source in [Hosted User Store](/identity/hosted-user-store.md) or [Database Connections](/identity/database-connections.md).
* Configure [Social Login](/identity/social-login.md) if your plan supports it.
* Review [Authentication Best Practices](/developers/authentication-best-practices.md).