---
title: "External apps | Customer's Canvas Hub"
canonical: "https://customerscanvas.com/docs/hub/admin-guide/settings/external-apps/"
---

# External apps

> On this tab, you can register applications that you connect to Customer's Canvas to use the BackOffice API. The obtained credentials provide Open API access to your account. To learn about the supported authentication schemes, refer to the [Authorization](https://customerscanvas.com/docs/hub/dev-center/api/auth.md) article.

Navigating to **Settings** > **External apps**, you can see what applications are already registered.

![External applications in BackOffice.](./images/settings-external-app.png)

1. **Name**. This is the internal name of an application.
2. **Client ID**. A unique string generated automatically.
3. **Authorization type**. This type [depends on your needs](https://customerscanvas.com/docs/hub/dev-center/api/auth.md#choosing-an-authentication-type).

## Creating external apps

To create a new external app, click **Create**.

When a new form opens, fill in the **Name** and **Authorization type** in the **App details**:

![Creating a new external app.](./images/settings-external-app-create-app-details.png)

1. **Name**. This is the internal name of an application.
2. **Authorization type**. In the drop-down list, select one of **Client Credentials**, **Implicit**, or **Authorization Code**.
3. **Client ID**. A unique string will be generated automatically.
4. **Secret key**. A unique string will be generated automatically.

### Client credentials

For the **Client credentials** type, you need to fill in **Access token lifetime**.

![Access token lifetime.](./images/settings-external-app-create-token.png)

Learn more about this value in the [Token lifetime](https://customerscanvas.com/docs/hub/dev-center/api/auth.md#token-lifetime) paragraph.

### Implicit

For the **Implicit** authorization type, you need to fill in the following fields:

![Redirect settings.](./images/settings-external-app-create-implicit.png)

Learn more about redirect settings in the [Redirect Settings](https://customerscanvas.com/docs/hub/dev-center/api/auth.md#redirect-settings) paragraph.

### Authorization code

For the **Authorization code** authorization type, you need to fill in the following fields.

![Authorization code.](./images/settings-external-app-create-permissions-authorization-code.png)

To learn when you need the client secret and PKCE, refer to the [Require client secret](https://customerscanvas.com/docs/hub/dev-center/api/auth.md#require-client-secret) and [Require PKCE](https://customerscanvas.com/docs/hub/dev-center/api/auth.md#require-pkce) paragraphs.

## Permissions

After filling in the app details, choose the Customer's Canvas resources which the application can manage and define the required _permissions_:

- **No Access** forbids access.
- **Full** allows creating, reading, updating, and deleting resources.
- **Read** allows only reading.

Let's see what resources you can manage.

![Resource types in BackOffice and their permissions.](./images/settings-external-app-create-permissions.png)

When you select the **Implicit** or **Authorization Code** type, all the resources will get the predefined permissions:

- **Full** access for **Assets**, **Private assets**, **Projects**, **Product specifications**, **Pipeline artifacts**, and **Storefront users**
- **No Access** for **Tenant configuration**