Create an M2M API client. The response contains the full client secret. This is the ONLY time it is ever shown; it is not stored anywhere.

POST

/account/m2m_client/

curl --request POST \
  --url https://api.siteqwality.com/account/m2m_client/ \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "name": "example", "description": "example", "scopes": [ "example" ] }'

• Production

Authorizations

• bearer_auth

Request Body ^required

Media type application/json

Body for POST /account/m2m_client.

object

name

required

Human-readable client name, e.g. “CI deploy hook”.

string

description

string | null

scopes

required

Granted scopes, e.g. ["read:monitors", "write:monitors"]. Must be non-empty and drawn from the documented scope taxonomy.

Array<string>

Example ^generated

{
  "name": "example",
  "description": "example",
  "scopes": [
    "example"
  ]
}

Responses

200

Client created; the secret is only returned once

Media type application/json

Response for create and rotate, the ONLY places a full secret appears. The secret is never stored and can never be retrieved again.

object

client

required

One M2M client in list responses. Never contains a secret; only the last four characters Stytch retains for display.

object

id

required

string format: uuid

client_id

required

Stytch client_id, the OAuth2 client_id used at the token endpoint.

string

name

required

string

description

string | null

scopes

required

Array<string>

created_at

required

string format: date-time

last_rotated_at

string | null format: date-time

client_secret

required

Full client secret. Shown exactly once; store it now.

string

token_endpoint

required

OAuth2 client_credentials token endpoint for this environment.

string

Example ^generated

{
  "client": {
    "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "client_id": "example",
    "name": "example",
    "description": "example",
    "scopes": [
      "example"
    ],
    "created_at": "2026-04-15T12:00:00Z",
    "last_rotated_at": "2026-04-15T12:00:00Z"
  },
  "client_secret": "example",
  "token_endpoint": "example"
}

400

Invalid name or scopes, or client cap reached

401

Missing or invalid authentication

403

Caller lacks the owner or admin role

500

Internal server error