An application that uses the Management API is registered as an app in the developer portal. Registration gives the app a client_id for Sign in with DJfindr and, for a confidential app, a client secret. People then connect the app to their DJfindr account by approving it on DJfindr.
Who can register
Any developer, DJ or client account can register apps, up to 10 apps per account. DJfindr staff accounts cannot.
| Account | How to open the developer portal |
|---|---|
| Developer account | Sign in at djfindr.com/developers/dashboard with an emailed code. |
| DJ or client account | Choose Log in with your DJ or client account on the same page and log in as usual, with your password, provider or two-factor authentication. |
The first time you open the portal, it asks you to agree to DJfindr's terms and conditions, privacy policy and the policies on the Legal page, and to show Powered by DJfindr attribution wherever you display catalog data. Then open Apps and choose Register an app.
Recent sign-inRegistering an app, rotating its client secret, changing its redirect URIs, creating or changing its webhook (any save of its URL or event types), rotating its webhook signing secret and deleting the app require a sign-in from the last 15 minutes. Otherwise the portal asks you to log in again.
Confidential or public
The type is chosen at registration and cannot be changed. To change it, register a new app.
| Type | Use it for | Client authentication |
|---|---|---|
| Confidential | An application that runs on a server and can keep a secret. | client_id and client secret (client_secret_basic) at the token endpoint, and PKCE. |
| Public | A mobile, desktop or browser application that cannot keep a secret. | client_id and PKCE only. A public app has no client secret and cannot register a webhook. |
PKCE (S256) is required for every app.
Redirect URIs
An app has 1 to 10 redirect URIs. DJfindr sends the authorization code only to a URI registered exactly as given.
| Rule | Detail |
|---|---|
| Format | Absolute, at most 2,048 characters, unique, without a fragment, a user name, a password or a wildcard. |
| Confidential app | https on a host that is not a loopback address. |
| Public app | https on a host that is not a loopback address, http on localhost, 127.0.0.1 or [::1] (any port), or a reverse-domain scheme of the app's own, such as com.example.app:/callback. |
| Refused hosts | DJfindr's own hosts (djfindr.com, djfi.site and every name under them), and the hosts of Claude and ChatGPT. |
A new redirect URI asks for approval againWhen you add a redirect URI, every person who already connected the app sees the consent screen again the first time the app signs them in at the new address. Removing a redirect URI does not affect tokens already issued.
The client secret
A confidential app receives a client secret (djf_cs_...) at registration. The portal shows it once; store it in your server's secret storage.
Rotating the secret (Client secret > Rotate secret) issues a new one, also shown once. The previous secret stops working immediately: your app needs the new secret to sign people in, refresh tokens and manage its webhook. Connected accounts stay connected, and access tokens already issued remain valid until they expire. If the app has a webhook, the rotation result shows its URL and when it last changed, so you can confirm it was not altered.
Name, logo, website and policies
| Field | Rules |
|---|---|
| Name | 1 to 64 characters, shown on the consent screen and in the person's connected apps. A name may not be DJfindr's or another app's (for example DJfindr, Dex, Claude, Anthropic, ChatGPT or OpenAI, including look-alike spellings). |
| Website, logo URL, privacy policy URL, terms URL | Optional. https on a public host, at most 2,048 characters, without a user name or password, and not a DJfindr, Claude or ChatGPT host. |
The logo is shown on the DJfindr consent screen from its URL; DJfindr does not copy it. The consent screen of an app that is not verified also shows the host of its first redirect URI next to its name, so people see where the sign-in returns.
Verified apps
For an app registered in the developer portal, a Verified label on the consent screen and in the person's connected apps means DJfindr staff checked the app. Two other kinds of client show it too: DJfindr's own apps, such as Dex, and a client that registers with a client ID metadata document (an MCP host), which is Verified because the document is published from the domain shown with its name, not because staff checked it. To request verification of your app, write to [email protected] with the app's client ID and website.
A change to a verified app's name, website, logo, privacy policy, terms or redirect URIs removes its verification. Request it again after the change.
Who can connect
| Account | Access |
|---|---|
| Client account | Can always connect the app. |
| DJ account on the Platinum plan | Can connect the app with every scope it requests. |
| DJ account on another plan | Can connect the app, but the token reads only the Public API (catalog:read) and the person's identity (openid, profile, email). Every Management API request answers 403 with code: "plan_required", and webhook deliveries for that DJ are skipped with plan. |
| DJfindr staff and developer accounts | Cannot connect apps. |
The plan is checked on every request. When a DJ upgrades to Platinum, the app's next request succeeds without a new approval; when the plan lapses, the next request answers plan_required. Nothing is revoked in either case. A DJ's own app is a third-party app to that DJ as well.
If the plan cannot be read, the request answers 503 with code: "unavailable" and is safe to retry; it never answers plan_required in that case.
Your app's webhook
A confidential app can receive webhooks. Set the URL and the event types on the app's page in the portal (Webhook), or with the app's client credentials at /{env}/v1/app/webhook. The portal also shows the delivery log, sends test events, rotates the signing secret and turns a webhook back on after it was disabled for failing. The webhook signing secret (whsec_...) is shown once, when the webhook is created or its secret is rotated.
Deleting an app
Delete app on the app's page disconnects every account that connected it, stops its tokens at once, and deletes its webhook and delivery log. This cannot be undone.
Apps turned off by DJfindr
DJfindr staff can turn off an app. A turned-off app shows Turned off by DJfindr in the portal: no one can sign in with it, its tokens are refused and its webhook is paused. While one of your apps is turned off, you cannot register or delete apps. Contact [email protected].
An app also stops working when the account that registered it is restricted or closed.
MCP hosts
AI assistants and other MCP hosts do not use the portal. They register themselves when a person connects them, through dynamic client registration at https://djfindr.com/api/auth/oauth2/register or a client ID metadata document. See Connecting an AI Assistant.