> ## Documentation Index
> Fetch the complete documentation index at: https://api.fanvue.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Create an app in the Fanvue Builder to get your OAuth Client ID and Secret, register your redirect URI, and pick the scopes your integration needs.

This is where every Fanvue integration begins. Creating an app gives you the **Client ID** and **Client Secret** you use to authenticate and the **scopes** that decide what your app can touch. Whether you are wiring up a private script or building a product for the App Store, you start here. 

<Note>
  ##### You need a Fanvue creator account with completed KYC

  Creating an app and managing OAuth credentials are available only to users registered as **creators** who have completed **KYC (identity verification)**. Fans cannot access the Builder area. See the [Quick Start prerequisites](/docs/introduction/quick-start).
</Note>

## Create an app

The Fanvue Builder (the Developer area) is where you create apps and manage their credentials. Creating an app takes a few minutes.

<Steps>
  <Step title="Open the Builder area">
    Sign in to Fanvue with your KYC-verified creator account and open the **Builder (Developer area)**, then create a new app.
  </Step>

  <Step title="Get your Client ID and Client Secret">
    Fanvue generates a **Client ID** (a public identifier) and a **Client Secret** (a server-side credential that authenticates your backend to Fanvue's token endpoint).

    <Warning>
      The Client Secret is shown **only once**, at the moment the app is created. Fanvue does not store it in retrievable form. Copy it into your secrets manager (or `.env.local` as `OAUTH_CLIENT_SECRET`) before leaving the page. If you lose it, your only option is to regenerate, which is a breaking change. See [Managing your OAuth client secret](/docs/authentication/implementation-guide#managing-your-oauth-client-secret).
    </Warning>
  </Step>

  <Step title="Add your redirect URI">
    Register the **redirect URI** Fanvue sends users back to after they authorize. It must match your app exactly, including the HTTPS protocol and port. For the [Fanvue App Starter](https://github.com/fanvue/fanvue-app-starter), use `https://my-fanvue-app.dev:3001/api/oauth/callback` in development and `https://YOUR_DOMAIN/api/oauth/callback` in production.
  </Step>

  <Step title="Choose your scopes">
    Select the scopes your app can request. They must match the scopes your code asks for (in the starter, `OAUTH_SCOPES`). Stick to the minimum your app needs. See [Scopes below](#choose-your-scopes).
  </Step>
</Steps>

<Info>
  On first connection users authorize through Fanvue's standard OAuth 2.0 flow, and you receive time-limited access tokens to call the API on their behalf. See the [Authentication Overview](/docs/authentication/overview) and [OAuth Quick Start](/docs/authentication/quick-start) for the full walkthrough.
</Info>

## Choose your scopes

Scopes are the permissions that control what your app can do once a user connects it. Every API request is checked against your token's scopes; a request without sufficient scopes returns `403 Forbidden`. Request only what your app actually needs, and remember users see the permissions you ask for when they connect.

| Resource       | Scopes                                        |
| -------------- | --------------------------------------------- |
| User           | `read:self`                                   |
| Chat           | `read:chat`, `write:chat`                     |
| Fan            | `read:fan`                                    |
| Creator        | `read:creator`, `write:creator`               |
| Media          | `read:media`, `write:media`                   |
| Posts          | `read:post`, `write:post`                     |
| Insights       | `read:insights`                               |
| Tracking Links | `read:tracking_links`, `write:tracking_links` |
| Agency         | `read:agency`, `write:agency`                 |

<Note>
  The scopes you select in the Builder must exactly match those your code requests. A mismatch is a common cause of authorization errors. For per-scope descriptions and setup details, see [Scopes](/docs/authentication/scopes).
</Note>

## Optional configuration

Depending on what you are building, your app may also configure:

* **Webhooks**, to receive platform events. Configure them in the **Events** tab of your app in the Developer area. See [Webhooks](/docs/webhooks/index).
* **Pricing**, if your app is paid. Listed apps charge through Fanvue's payment rails: [pricing plans](/docs/app-store/payments/pricing-plans) and [one-time items](/docs/app-store/payments/one-time-items), configured in the **Pricing** tab of your app. Start with [App Payments](/docs/app-store/payments/overview).

## Next steps

<CardGroup cols={2}>
  <Card title="OAuth Quick Start" icon="bolt" href="/docs/authentication/quick-start">
    Wire your Client ID, Secret, and scopes into a working Next.js app.
  </Card>

  <Card title="App Types" icon="layer-group" href="/docs/app-store/app-types">
    Embedded vs off-platform, and how listing interacts with payment rails.
  </Card>

  <Card title="Implementation Guide" icon="lock" href="/docs/authentication/implementation-guide">
    Token exchange, refresh, and secret lifecycle in depth.
  </Card>

  <Card title="Test your app safely" icon="flask" href="/docs/introduction/testing-your-app">
    Set up a test creator account so development never touches your real profile.
  </Card>
</CardGroup>