This article is for developers who are creating applications with the Open Integration Platform using token authentication.  If you happen to be working with a software solution provided by a third-party vendor that is using the Open Integration Platform please reference this article, How do Open Integration Platform Vendor Applications Manage Login for Firm Users

Register a new client application to obtain a client ID and client secret with the following steps:

1. Install any CCH Axcess product as described in How do I install, repair, uninstall, or download CCH Axcess™ products?
2. Login into CCH Axcess Dashboard using:
   • Your account number that is licensed for Open Integration
   • A userID that has permission to view firm settings
3. Navigate to Dashboard > Application Links > Firm > Developer Tools
4. Click Add Application.
5. Enter the application details
   • Application Name - Users see this name when prompted to grant access to your application
   • Application Type - We recommend Authorization Code because it is more secure than Implicit. More details are in Comparing Authorization Code and Implicit flows and application types in OIP Token Authentication
   • Description
   • Access token lifetime - An access token is used when making an API request to a protected resource. This setting determines when this this type of a token will expire. For more details refer to the implementation instructions in the Additional Information section below.
   • Refresh token lifetime - When using authorization code flow, a refresh token is used to obtain a new access token. This setting determines when a refresh token will expire. For more details refer to the implementation instructions in the Additional Information section below.
6. Select the scopes required by your application. We recommend using the following scopes:
   • CCHAxcess_data_writeaccess - Allows the application to read or write CCH Axcess data as determined by the user's licenses and membership in security groups.
   • CCHAxcess_Profile - Provides additional information in the ID token about the authorizing user such as email and name. 
   • IDInfo - Required to obtain the ID token that us used for logout.
   • offline_access - Required to obtain a refresh token.
   • Openid - Required to have sub claims.
7. Enter re-direct URLs such as https://www.yourOIPapp.net which are used for login and logout flows. Localhost is not an allowed re-direct URL, it is blocked due to security concerns. For more details refer to the implementation instructions and reply URL restriction error in the Additional Information section below.
8. Copy the client ID and client secret into some secure storage that you manage. These will be used in your implementation.