Organizations, applications and credentials
How applications are registered, what credentials you get, and how to keep them safe.
SANDBOX ONLY — the API is live and answering, and the portal at www.ryde.us.com/developer issues sandbox credentials automatically. Production credentials are NOT issued yet: production access is reviewed per organization, and per application after that. Build and test against sandbox now; do not schedule a production launch until your organization is approved.
Organization
|
+-- Application A (sandbox credentials, then production on review)
+-- Application B
+-- Application CPublic and confidential clients
| Type | Use it for | Secret |
|---|---|---|
| Confidential | A server you control. | Issued. Shown once, stored hashed — Ryde cannot show it to you again. |
| Public | Mobile apps, browser apps, desktop binaries, anything a user could inspect. | None. PKCE replaces it. |
Never put a client secret in a mobile app, front-end JavaScript, a public repository, a desktop binary, or an AI prompt. A secret shipped to a device is not a secret. If your application runs anywhere a user can look at it, register it as a public client and use PKCE.
Rotation
Rotate a secret from the portal at any time. Rotation issues the new secret with an overlap window in which both work, so you can deploy without a moment of downtime — then the old one stops. Rotate immediately if a secret was ever committed, logged, or pasted anywhere it could be read.
Sandbox and production
create account -> accept Developer Agreement -> create app
|
SANDBOX CREDENTIALS (automatic)
|
build and test
|
request production access
|
RYDE REVIEW
|
PRODUCTION CREDENTIALS