Enter a name for the confidential application. You can enter up to 125 characters.

Consider keeping your application names as short as possible. In this example use, Spreadsheet addins.

This field is optional. You can skip this field.

Click Upload to add an icon that represents the application. This icon appears next to the name of the application on the My Apps page and the Applications page

Enter the URL (HTTP or HTTPS) where the user is redirected after a successful login.

In the Custom Login URL field, you can specify a custom login URL. However, if you are using a default login page provided by Oracle Identity Cloud Service, then leave this field blank.

In the Custom Logout URL field, you can specify a custom logout URL. However, if you are using a default login page provided by Oracle Identity Cloud Service, then leave this field blank.

You can enter the error page URL to which a user has to be redirected, only in case of a failure. If not specified, the tenant specific Error page URL will be used.

You select the check box only if you want the confidential application to be listed for users on their My Apps pages. In this case you need to configure the application as a resource server.

You select the check box only if you want end users to be able to request access to the app from their My Apps page.

Click Add Tag only if you want to add tags to your confidential applications to organize and identify them.

Define how long (in seconds) the access token associated with your confidential application remains valid.

Select this check box only if you want to use the refresh token that you obtain when using the Resource Owner, Authorization Code, or Assertion grant types.

You can define how long (in seconds) the refresh token, which is returned with your access token and is associated with your confidential application, remains valid.

Enter “ords/”.

This the primary recipient where the access token of your confidential application is processed.

You must enter the secondary recipients where the access token of your confidential application is processed, and click Add. In this example, you do not have any secondary recipients.

To specify which parts of other applications that you want your application to access, click this button to add those scopes to your confidential application.

Use only when the resource owner has a trust relationship with the confidential application, such as a computer operating system or a highly privileged application, because the confidential application must discard the password after using it to obtain the access token.

Use only when the authorization scope is limited to the protected resources under the control of the client or to the protected resources registered with the authorization server.

Use only when you want to use an existing trust relationship expressed as an assertion and without a direct user approval step at the authorization server.

Use only when you want to use an existing trust relationship expressed as a SAML2 assertion and without a direct user approval step at the authorization server.

Select this grant type only when you want a refresh token supplied by the authorization server, and then use it to obtain a new access token.

Select this grant type only when you want to obtain an authorization code by using an authorization server as an intermediary between the client application and resource owner.

If the application can't keep client credentials confidential for use in authenticating with the authorization server, then select this check box. For example, your application is implemented in a web browser using a scripting language such as JavaScript. An access token is returned to the client through a browser redirect in response to the resource owner authorization request (rather than an intermediate authorization).

Select the Device Code grant type only if the client doesn't have the capability to receive requests from the OAuth Authorization Server, for example, it cannot act as an HTTP server such as game consoles, streaming media players, digital picture frames, and others.

Select the TLS Client Authentication grant type only to use the client certificate to authenticate with the client. If a token request comes with an X.509 client certificate and the requested client is configured with the TLS Client Authentication grant type, the OAuth service uses the Client_ID in the request to identify the client and validate the client certificate with the certificate in the client configuration. The client is successfully authenticated only if the two values match.

Select this check box only if you want to use HTTP URLs for the Redirect URL, Logout URL, or Post Logout Redirect URL fields. For example, if you are sending requests internally, want a non-encrypted communication, or want to be backward-compatible with OAuth 1.0, then you can use an HTTP URL.

Skip this field.

Enter the following URL where you want to redirect the user after logging out of the application. https://static.oracle.com/cdn/spreadsheet/red-4/redirector.html

Select Confidential.

The available client types are Trusted and Confidential. Choose Trusted only if the client can generate self signed user assertions.

Skip this field. It is optional.

• Select the Introspect check box only if you want to allow access to a token introspection end point for your application.

• Select the On behalf Of check box only if you want to ensure that access privileges can be generated from the user's privileges alone. This allows the client application to access endpoints to which the user has access, even if the client application by itself would not normally have access.

The default is none.

Select All.

You can select any one of the following options to allow a client application to access authorized resources:

• All – Access any resource within a domain (All). See Accessing All Resources.
• Tagged – Access any resource with matching tags (Tagged). See Accessing Resources With Matching Tags.
• Specific – Access only those resources where an explicit association between the client and the resource (Specific) exists. See Accessing Resources With Specific Scopes.

Only if you want your application to access APIs from other applications, then click Add in the Token Issuance Policy section of the Add Confidential Application page.

Click Add to enable your confidential application to access Oracle Identity Cloud Service APIs.

In the Add App Role window, select the application roles that you want to assign to this application. This enables your application to access the REST APIs that each of the assigned application roles can access.