# OAuth information
The information in the `OAuth Information` section of the manifest JSON represents these values on the **Development** view of the app build flow:
- **Basic Information** > **[Usage](/docs/build-flow/basic-info/app-mgmt/)**.
- **Basic Information** > **[OAuth information](/docs/build-flow/basic-info/oauth-info/)**.
- **Scope** > **[Add Scopes](/docs/build-flow/quick-start-guide/#step-4--select-the-scopes-zoom-api-methods)**.
## Manifest JSON
```json
{
"oauth_information": {
"usage": "",
"development_redirect_uri": "",
"production_redirect_uri": "",
"oauth_allow_list": ["", ""],
"strict_mode": false,
"subdomain_strict_mode": false,
"scopes": [
{
"scope": "user:read:email",
"optional": false
}
],
"scope_description": "scope description",
"enable_private_pkce_client": false,
"enable_public_pkce_client": false,
"development_public_key": null,
"production_public_key": null
}
}
```
## Field Description
| Field | Description | Required |
| :--------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------- |
| `usage` | How the app is managed
• account level: `ADMIN_MANAGEMENT`
• user level: `USER_OPERATION` | Yes |
| `development_redirect_uri` | Provide the development redirect URL to generate an authorization URL for development testing. | Yes |
| `production_redirect_uri` | Provide the production redirect URL to generate an authorization URL for development testing. | No |
| `oauth_allow_list` | OAuth Allow Lists | No |
| `strict_mode` | This option only allows the redirections that exactly match the valid OAuth redirect URLs. [Learn more](/docs/build-flow/basic-info/oauth-info/#strict-mode-and-subdomain-checks-disabled) | No |
| `subdomain_strict_mode` | This option only allows the redirections that exactly match the subdomain of the valid OAuth redirect URLs. [Learn more](/docs/build-flow/basic-info/oauth-info/#strict-mode-and-subdomain-checks-disabled) | No |
| `scopes` | Scopes define the API methods this app is allowed to call. Scopes are restricted to specific resources like channels or files. [Learn more](/docs/build-flow/quick-start-guide/#step-4--select-the-scopes-zoom-api-methods) | No |
| `scope_description` | Describe how your app intends to use the selected scope(s) | No |
| `enable_private_pkce_client` | PKCE for _development_ app.
[Learn more](/docs/integrations/oauth/#using-proof-key-for-code-exchange-pkce) | No |
| `enable_public_pkce_client` | PKCE for _production_ app.
[Learn more](/docs/integrations/oauth/#using-proof-key-for-code-exchange-pkce) | No |
| `development_public_key` | Public key configuration used for verifying JWT assertions in the development environment. Contains the JWKS inline or a well-known URL. | No |
| `development_public_key.enabled` | Whether the public key feature is enabled for the development client. | No |
| `development_public_key.well_known_url` | URL pointing to a JWKS endpoint (e.g. https://auth.example.com/.well-known/jwks.json). Mutually exclusive with keys. | No |
| `development_public_key.keys` | Inline list of JSON Web Key (JWK) objects (RFC 7517). Mutually exclusive with well_known_url. | No |
| `development_public_key.keys[].kty` | Key type. Identifies the cryptographic algorithm family, e.g. "RSA", "EC". (RFC 7517 §4.1) | Yes |
| `development_public_key.keys[].kid` | Key ID used to match a specific key. (RFC 7517 §4.5) | No |
| `development_public_key.keys[].alg` | Algorithm intended for use with the key, e.g. "RS256". (RFC 7517 §4.4) | No |
| `development_public_key.keys[].key_ops` | Key operations, e.g. ["sign"], ["verify"]. (RFC 7517 §4.3) | No |
| `development_public_key.keys[].n` | RSA modulus (base64url-encoded). Required for RSA keys. (RFC 7518 §6.3.1.1) | No |
| `development_public_key.keys[].e` | RSA public exponent (base64url-encoded). Required for RSA keys. (RFC 7518 §6.3.1.2) | No |
| `development_public_key.keys[].crv` | EC curve name, e.g. "P-256", "P-384". Required for EC keys. (RFC 7518 §6.2.1.1) | No |
| `development_public_key.keys[].x` | EC x-coordinate (base64url-encoded). Required for EC keys. (RFC 7518 §6.2.1.2) | No |
| `development_public_key.keys[].y` | EC y-coordinate (base64url-encoded). Required for EC keys. (RFC 7518 §6.2.1.3) | No |
| `development_public_key.keys[].x5u` | X.509 URL. (RFC 7517 §4.6) | No |
| `development_public_key.keys[].x5c` | X.509 certificate chain (base64-encoded DER). (RFC 7517 §4.7) | No |
| `development_public_key.keys[].x5t` | X.509 SHA-1 thumbprint (base64url). (RFC 7517 §4.8) | No |
| `development_public_key.keys[].x5t#S256` | X.509 SHA-256 thumbprint (base64url). (RFC 7517 §4.9) | No |
| `production_public_key` | Public key configuration used for verifying JWT assertions in the production environment. Contains the JWKS inline or a well-known URL. | No |
| `production_public_key...` | Same subfields as `development_public_key` | |