Kinde · Module

Applications API

Kinde applications are OAuth 2.0 clients that receive access tokens for application code. Select the application type that matches the client, then authorize APIs and request their audience when API access is required.

How it works

Applications represent the OAuth clients that receive tokens for your product. Choose an application type for the client’s role, connect it to a registered API when needed, and request the API audience so the resulting token can authorize calls to that API.

Returns

An OAuth 2.0 access token for the requested API audience; the documentation does not define a programming-language return signature.

Key points

Applications use OAuth 2.0 to transfer access tokens securely to application code.
Customer-identity applications cover your product’s front-end, back-end, and machine-to-machine clients.
M2M applications are designed for backend services that call APIs.
An M2M client can access the Kinde Management API after authorization.
Non-interactive clients such as command-line tools, daemons, and IoT devices are also suitable M2M use cases.

Common mistakes

An API must be registered with Kinde before configuring application access.

Example: Call an API with a Kinde access token

import { KindeClient } from "@kinde/js-utils";

const token = await KindeClient.getToken({
  audience: "https://api.example.com"
});

const response = await fetch("https://api.example.com/data", {
  headers: { Authorization: `Bearer ${token}` }
});

console.log(await response.json());

Requests an access token for the registered API audience, then sends it to the API in the Bearer header.

When to use it

Backend API access

A server needs to call a protected API.

Kinde Management API integration

A service needs to manage Kinde resources programmatically.

CLI, daemon, or IoT client

A non-interactive tool must authenticate without a user session.

Single-page web application

A browser-based product needs user sign-in.

Interview questions

QWhat is a Kinde application?

Applications are OAuth clients used to obtain access tokens for application code. Kinde supports application types such as regular web, single-page web, and machine-to-machine applications, each suited to a different execution environment.

Follow-up: How would a backend service call the Kinde Management API? Create an M2M application, authorize it for the API, and use its credentials to obtain a token.

QHow does an application obtain access to a custom API?

Register the API in Kinde, link or authorize it for the application, and request its audience when initializing the SDK or requesting a token. The audience then appears in the token’s aud claim.

Follow-up: How do you restrict what an authorized application can do? Enable only the required API scopes for that application.

QWhen should you choose an M2M application?

M2M applications are intended for backend services that need API access, including Kinde’s Management API. They also fit non-interactive clients such as CLIs, daemons, and IoT devices.

Follow-up: Why should a browser app not use M2M credentials? M2M secrets belong on trusted server-side systems and must not be exposed to browser code.

Kinde APIs
Machine to machine (M2M) applications
Register and manage APIs
About scopes and Kinde API access
Secure your API using scopes

Source: Applications in Kinde. Checked 2026-10-15.