Before an integration can authenticate with OAuth, you need to register it as an application in Leadfeeder. This is where you name it, set its redirect URLs, and decide what it is allowed to do.
Before you start
You need the Applications Management company permission. If you do not have it, the "Developer Access" section will not appear in your Company settings. Ask a company admin to enable it for you.
Account creators have this permission by default.
Create an application
Log in to Leadfeeder and open Settings.
Go to the Company tab, then select Applications under Developer Access.
Click New Application.
Fill in the application details, then click Save changes.
The fields
Field | Required | What it does |
Application Name | Yes | The name shown to anyone authorizing the application. Use something they will recognise. |
Description | No | A short line explaining what the application does. Shown on the authorization screen. |
Logo | No | PNG or JPEG, up to 1 MB. 120x120 px or larger is recommended. Shown on the authorization screen. |
Application Type | Yes | "Internal" for use inside your own organisation. "Public", for third-party developers, is coming soon. |
Authorized redirect URLs | Yes | Where Leadfeeder sends the user back after they approve access. Only URLs listed here are accepted. Click "Add URL" to add more than one. |
Scopes | Yes | What the application is allowed to read and write. Search by keyword and select one or more. |
For the full list of scopes and what each one covers, see OAuth endpoints, scopes and the authorization flow.
Get your Client ID and Client Secret
When you save the application, Leadfeeder generates a Client ID and a Client Secret.
Copy the Client Secret straight away and store it somewhere safe, such as a password manager. It is shown in full only once. After that the page displays a masked version, for example ••••••••••••f914, so you can tell which secret is in use without exposing it.
The Client ID stays visible on the application page and can be copied at any time.
Manage an existing application
Open Settings > Company > Developer Access > Applications and click the application name.
From there you can:
Edit the name, description, logo, redirect URLs, and scopes.
Create a new Client Secret if the current one is compromised or you rotate credentials on a schedule.
Review which scopes are currently granted.
Rotating the Client Secret
Click Create new Client Secret. The old secret stops working immediately. There is no grace period, so update your integration in the same maintenance window.
Changing scopes
Adding and removing scopes behave differently.
Adding a scope does not take effect on its own. The application keeps operating on the scopes that were approved when the user authorized it. Users need to go through the authorization flow again and approve the new permissions.
Removing a scope takes effect immediately. Any call the application makes against the removed scope will start failing straight away.
Security recommendations
Treat the Client Secret like a password. Never commit it to a repository or paste it into a ticket.
Store it in environment variables or a secrets manager, not in your source code.
Only request the scopes the integration actually needs. If it only reads companies, do not grant write access.
Rotate the secret if you suspect it has leaked, or if someone with access to it leaves.
--
Questions, comments, feedback? Please let us know by contacting our support team via the chat or by sending us an email at support@leadfeeder