Enable Connect

In the PortModels console → Apps → your app → Connect with PortModels:

1. Add your redirect URIs#

Redirect URIs are matched exactly. https is required; http is allowed only for localhost. Device-flow-only public clients don't need any.

https://yourapp.com/callback
http://localhost:5173/callback

Exact match means query strings and trailing slashes matter. Register every URI you will actually use, including your development one.

2. Tick the scopes your app may request#

An app can only ever request scopes enabled here. Enable the minimum you need — users see the list on the consent screen, and an app asking for file access it doesn't use converts worse. See Scopes.

3. Pick your client type#

Confidential (default) — your app has a backend that can keep a secret. Click Enable — generate client secret and copy the client_secret (pmcs_...). It is shown once.

Public — desktop and CLI apps that cannot hold a secret. There is no button to click: saving your redirect URIs and scopes with the public toggle on enables Connect. Authenticate with PKCE or the device flow instead of a secret.

Your client ID#

Your client_id is your app id either way, which is always <your-publisher-namespace>/<app-name>:

acme/chatbot

URL-encode the slash as %2F when you put it in an authorize link:

client_id=acme%2Fchatbot