To create a client in Ory Hydra, you can use the

hydra create client

command. This command creates an OAuth 2.0 Client which can be used to perform various OAuth 2.0 Flows like the Authorize Code, Implicit, Refresh flow. This command allows settings all fields defined in the OpenID Connect Dynamic Client Registration standard. Here is an example of how to use the command:

bash client=$(hydra create client \    --endpoint <http://127.0.0.1:4445> \    --format json \    --grant-type authorization_code,refresh_token \    --response-type code,id_token, email \    --scope openid,offline_access,profile,email \    --redirect-uri <http://gitlab.example.com:8000/users/auth/Ory_Hydra/callback> \    --token-endpoint-auth-method client_secret_post)      client_id=$(echo $client | jq -r '.client_id')   client_secret=$(echo $client | jq -r '.client_secret')

You can also use the binary within the docker-container:

bash docker-compose -f quickstart.yml exec hydra \    hydra create client \    --endpoint <http://127.0.0.1:4445> \    --id "$client_id" \    --secret "$client_secret" \    --grant-type authorization_code,refresh_token \    --response-type code,id_token,email \    --scope openid,offline_access,profile,email \    --redirect-uri <http://gitlab.example.com:8000/users/auth/Ory_Hydra/callback> \    --token-endpoint-auth-method client_secret_post

Once you have created the client, you can perform the OAuth2 Client Credentials Flow using the

hydra perform client-credentials

command. This command is useful to exchange a

client_id

and

client_secret

for an

access_token

. Here is an example of how to use the command:

bash hydra perform client-credentials --client-id ... --client-secret

Please note that the Kratos identity is not directly involved in creating the client in Hydra or performing the client credentials flow. Kratos is used for managing user identities, while Hydra is used for managing OAuth 2.0 and OpenID Connect clients. Sources: - [Creating the client in Ory Hydra](https://www.ory.sh/docs/hydra/self-hosted/gitlab#creating-the-client-in-ory-hydra) - [hydra create client](https://www.ory.sh/docs/hydra/cli/hydra-create-client#hydra-create-client) - [hydra perform client-credentials](https://www.ory.sh/docs/hydra/cli/hydra-perform-client-credentials#hydra-perform-client-credentials)

Running

ory patch oauth2-config

again with

--add '/oauth2/token_hook/...'

will apply another JSON Patch operation to the same config; it does not create “multiple webhooks” as separate entries, because

oauth2.token_hook

is a single field in the OAuth2 config schema. [Token hook config; Patch oauth2-config] However, the exact behavior depends on the JSON Patch operation and the path: •

--add '/oauth2/token_hook/url="..."'

on an existing scalar field typically behaves like a replace for that field in practice (you end up with the new URL value). • If you instead use

--replace '/oauth2/token_hook/url="..."'

, it will explicitly overwrite the existing value. [Patch config format; Patch oauth2-config] The docs don’t show multiple token hooks or an array of hooks, only a single

oauth2.token_hook

object or string, so conceptually you’re always updating that one webhook configuration, not adding another distinct webhook. [Token hook config] 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.

You can inspect the current OAuth2 token webhook configuration by fetching the OAuth2 config for your project:

ory get oauth2-config --project <project-id> --workspace <workspace-id> --format json-pretty

Then look under the

oauth2.token_hook

section in the output. [Get oauth2-config; OAuth2 CLI guide] 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.