Which credential do I use?
Most applications need a client ID, a backend-only client secret, and the user tokens produced during login. Management tokens are only for provisioning automation.
What the React SDK can access
@authie/nextjs/react reads a small session response from your application’s same-origin backend: the user ID, name, email, verification status, and optional image. It does not receive the secret key, authorization code, access token, or refresh token.
The complete map
| Credential | Represents | Where it belongs | Used for |
|---|---|---|---|
| Developer session | You, signed into the Authie console | Your browser | Manual configuration |
| Management token | An organization administrator | Trusted CLI, CI, or local provisioning process | Creating applications and OAuth clients |
| Client ID | One OAuth integration | Backend or public client | Identifying the application during OIDC |
| Client secret | A confidential OAuth client | Backend secret storage only | Authenticating the client at the token endpoint |
| Authorization code | One completed login attempt | Short-lived callback handling | Exchanging for tokens |
| ID token | The authentication event | Backend/session layer | Establishing the local session after validation |
| Access token | Permission to call an API for this user and application | Trusted backend; protected storage for public clients | Calling /me, /status, and permitted APIs |
| Refresh token | Permission to obtain replacement access tokens | Server-side or OS-protected storage | Keeping a session alive through rotation |
Why the management token exists
Creating an OAuth client is a control-plane operation. It establishes redirect URIs that Authie will trust, chooses whether a secret exists, and determines which organization owns the resulting application. A normal user token must not have that authority.
The client secret cannot do this job either: it does not exist until after the client is created, and it identifies one client rather than the organization that is allowed to create clients.
What it should do
Create organization-owned applications and their OAuth clients from a trusted automation environment.
What it must never do
Power login, sit in frontend code, travel with application requests, or become Storytail’s general-purpose API key.
Management-token protections
- Organization-scoped
- Shown only once
- Stored by Authie as a SHA-256 digest
- Optionally expiring
- Individually revocable
- Auditable when it creates an application
See Management API when you actually need provisioning automation.