# Creating OAuth clients

> Each third party you share with gets its own OAuth client: a client ID and a client secret it uses to ask merchants for access and to get tokens.

Each third party you share with gets its own OAuth client: a client ID and a client secret it uses to ask merchants for access and to get tokens.

Once account sharing is enabled for your application, the **Developer** tab has a section for creating OAuth clients. Create one per third party, in each environment it needs: a sandbox client only works with sandbox accounts, and a live client with live accounts.

Give the third party:

- The **client ID** and **client secret**
- A link to [Connecting to shared accounts](/platforms/account-sharing/connect/), which describes the flow they implement

Treat the client secret like an API key: send it securely, and create a new client if it may have leaked.

A third party can only reach accounts that their merchant has connected to the Merchant Portal and then chosen during the flow. Creating a client gives it no access by itself.