Register the OIDC-Connect PHP example

Create a new personal OAuth application in user.m7.org for each website that deploys the OIDC-Connect PHP example.

Replace every angle-bracketed value. <HTTPS_ORIGIN> is the deployment's HTTPS scheme and hostname, with an optional non-default port, but no path or trailing slash. Register only origins the application actually serves; do not use wildcard callback URLs.

Field	Value
Name	<APPLICATION_NAME>
Application type	web
Admin application	Off
Redirect URI	<HTTPS_ORIGIN>/oidc-connect/m7_sso_session/callback
Post-logout URI	<HTTPS_ORIGIN>/oidc-connect/
Initiate login URI	<HTTPS_ORIGIN>/oidc-connect/m7_sso_session/login
Token authentication	client_secret_basic
Response type	code
Grant types	authorization_code, refresh_token
Require PKCE	Enabled
DPoP policy	required
ID-token algorithm	RS256
Allowed audience	https://api.user.m7.org/
Allowed scopes	openid, profile, email, offline_access
Refresh binding policy	required
UserInfo signing	JSON/default
Status	active

Leave client-credentials grant settings, device-code settings, IP restrictions, default maximum authentication age, custom claims, and the personal certificate disabled or blank.

Generate a strong client secret when selecting client_secret_basic and save it directly in deployment secret storage. Its plaintext value is not recoverable later. Never put the secret in browser code, source control, URLs, logs, screenshots, support tickets, or chat.

Retain the public client ID from this registration for M7_CLIENT_ID. Supply the saved secret separately as M7_CLIENT_SECRET in the server-only configuration. The Apache deployment template identifies these registration-derived values and keeps all application-specific values as placeholders.

The nested callback is deliberate: the example owns an independent /oidc-connect/m7_sso_session/ SDK installation without disturbing another M7 session bridge at the website root.