Create an application (sandbox)

One project, two records: a sandbox one you build against and a production one you earn.

The shape of it

An application belongs to a project, and a project holds at most two application records: one with environment: "sandbox" and one with environment: "production". They are separate records with separate client ids and separate client secrets. They are not two modes of one credential.

You start with the sandbox record. The production record is created later, and creating it is itself the first item on the go-live checklist.

The normal way: the console

Create the application in the developer console. Everything the checklist later asks about — name, homepage, privacy policy, terms, redirect URIs — is edited at /applications/<applicationId>/settings, and the checklist tells you that path back when a check fails.

What the console sends

The New application screen (/applications/new in the developer console) sends POST /v1/developer/applications from your signed-in session. It takes the fields below. name, redirectUris and allowedClaimScopes are required; the rest are optional at creation and required later, at go-live.

Request body

namerequired: 1–150 characters. This is the name on the consent screen.
redirectUrisrequired: A non-empty array. At least one must be https before the application can go to production.
allowedClaimScopesrequired: A non-empty array — the ceiling of what this application may ever request. See Choosing claims.
environment: sandbox or production. Omit it for a sandbox application.
signInMode: standard, the default, or private. Chosen once: it cannot be changed, and the production record keeps it. See Private sign-in.
description: Up to 1000 characters.
websiteUrl: Absolute URL, protocol required.
privacyPolicyUrl: Absolute URL, protocol required. Required to go live, and it must be https.
termsUrl: Absolute URL, protocol required. Required to go live, and it must be https.
supportEmail: A valid email address.
allowedDataCategories: Carries the document policy. Nothing is released from an identity document without it — see Identity documents.

Create a sandbox application (what the console sends)

POST /v1/developer/applications
content-type: application/json

{
  "name": "Acme Checkout",
  "redirectUris": ["https://localhost:8443/callback"],
  "allowedClaimScopes": ["openid", "profile", "email", "age_over_18"]
}

Read back what you just made

The application's Quickstart screen (/applications/<applicationId>/quickstart) shows the copy-ready values for the project's *sandbox* client, whichever record you open: the client id exactly as registered, the redirect URIs character for character, the scopes, whether the client is public or confidential, and every endpoint URL. It reads them from one session-bound route:

Quickstart (what the console reads)

GET /v1/developer/applications/{applicationId}/quickstart

What comes back under data

sandbox: applicationId, name, status, clientId, redirectUris, primaryRedirectUri, scopes, and clientType — public until the sandbox client's first secret is issued, confidential from then on. See Public or confidential.
endpoints: issuer, discovery, authorization, token, userinfo, jwks.
firstSignIn: The first token issuance on the sandbox client, and how it happened.
recentSignIns: windowDays, count, lastAt, testIdentity, tester, teamMember — the same 30-day window the go-live checklist reads.
testIdentities: count and cap.
sdks: The SDK packages the quickstart hub links to.

What this does not do

Creating an application grants you nothing. allowedClaimScopes is a ceiling, not an entitlement. Nothing moves until a person approves it, and what they approve is what you receive.
Restricted scopes can be tested in Sandbox. Only eligible invited testers and application-scoped test identities can sign in there. Production use of date_of_birth, profile_photo or profile_photo_comparison requires review. Sandbox photo comparisons are simulated.
A sandbox application only works for your own team and its test identities. It is not a free tier. Real people cannot sign into it.

Verified against API commit 234dba22 on 2026-10-18. The routes, scopes, checklist, events and limits on these pages are read from that export, not typed.