diff --git a/frontend/auth/admin/AdminApp.vue b/frontend/auth/admin/AdminApp.vue
index ea53db5..5012cba 100644
--- a/frontend/auth/admin/AdminApp.vue
+++ b/frontend/auth/admin/AdminApp.vue
@@ -406,18 +406,44 @@ function deletePermission(p) {
 }
 
 // OIDC Client actions
-function createOidcClient() {
-  openDialog('oidc-create', { name: '', redirect_uris: '' })
+async function createOidcClient() {
+  try {
+    // Create the record on the server immediately, then open edit dialog
+    const result = await apiJson('/auth/api/admin/oidc-clients', { method: 'POST', body: {} })
+    await loadOidcClients()
+    openDialog('oidc-edit', {
+      client_id: result.client_id,
+      client_secret: result.client_secret,
+      isNew: true,
+      name: '',
+      redirect_uris: ''
+    })
+  } catch (e) {
+    authStore.showMessage(e.message || 'Failed to create OIDC client', 'error')
+  }
 }
 
 function editOidcClient(client) {
   openDialog('oidc-edit', {
-    client,
+    client_id: client.uuid,
     name: client.name,
     redirect_uris: client.redirect_uris.join('\n')
   })
 }
 
+async function resetOidcSecret(clientId) {
+  try {
+    const result = await apiJson(`/auth/api/admin/oidc-clients/${clientId}/reset-secret`, { method: 'POST' })
+    // Update the dialog data in place so the new secret is shown
+    if (dialog.value.type === 'oidc-edit' && dialog.value.data?.client_id === clientId) {
+      dialog.value.data.client_secret = result.client_secret
+    }
+    authStore.showMessage('Client secret has been reset.', 'success', 2500)
+  } catch (e) {
+    authStore.showMessage(e.message || 'Failed to reset client secret', 'error')
+  }
+}
+
 function deleteOidcClient(client) {
   openDialog('confirm', {
     message: `Delete OIDC client "${client.name}"? This will break any applications using this client.`,
@@ -771,51 +797,18 @@ async function submitDialog() {
           authStore.showMessage(e.message || 'Failed to create permission', 'error')
         })
       return // Don't call closeDialog() again
-    } else if (t === 'oidc-create') {
-      const name = dialog.value.data.name?.trim()
-      const uris = dialog.value.data.redirect_uris?.trim()
-      if (!name) throw new Error('Client name required')
-      if (!uris) throw new Error('Redirect URIs required')
-
-      const redirect_uris = uris.split('\n').map(u => u.trim()).filter(u => u)
-      if (redirect_uris.length === 0) throw new Error('At least one redirect URI required')
-
-      // Close dialog immediately, then perform async operation
-      closeDialog()
-      apiJson('/auth/api/admin/oidc-clients', { method: 'POST', body: { name, redirect_uris } })
-        .then((result) => {
-          // Show success dialog with client credentials
-          openDialog('oidc-created', {
-            client_id: result.client_id,
-            client_secret: result.client_secret
-          })
-          loadOidcClients()
-        })
-        .catch(e => {
-          authStore.showMessage(e.message || 'Failed to create OIDC client', 'error')
-        })
-      return // Don't call closeDialog() again
     } else if (t === 'oidc-edit') {
-      const { client } = dialog.value.data
+      const { client_id } = dialog.value.data
       const name = dialog.value.data.name?.trim()
       const uris = dialog.value.data.redirect_uris?.trim()
       if (!name) throw new Error('Client name required')
-      if (!uris) throw new Error('Redirect URIs required')
 
-      const redirect_uris = uris.split('\n').map(u => u.trim()).filter(u => u)
-      if (redirect_uris.length === 0) throw new Error('At least one redirect URI required')
+      const redirect_uris = uris ? uris.split('\n').map(u => u.trim()).filter(u => u) : []
 
       // Close dialog immediately, then perform async operation
       closeDialog()
 
-      // Check if anything changed
-      const oldUris = [...client.redirect_uris].sort().join('\n')
-      const newUris = [...redirect_uris].sort().join('\n')
-      if (name === client.name && oldUris === newUris) {
-        return // No changes
-      }
-
-      apiJson(`/auth/api/admin/oidc-clients/${client.uuid}`, { method: 'PATCH', body: { name, redirect_uris } })
+      apiJson(`/auth/api/admin/oidc-clients/${client_id}`, { method: 'PATCH', body: { name, redirect_uris } })
         .then(() => {
           authStore.showMessage(`OIDC client "${name}" updated.`, 'success', 2500)
           loadOidcClients()
@@ -942,6 +935,7 @@ async function submitDialog() {
       :settings="authStore.settings"
       @submit-dialog="submitDialog"
       @close-dialog="closeDialog"
+      @reset-oidc-secret="resetOidcSecret"
     />
   </div>
 </template>
diff --git a/frontend/src/admin/AdminDialogs.vue b/frontend/src/admin/AdminDialogs.vue
index 438ebc9..e3b3880 100644
--- a/frontend/src/admin/AdminDialogs.vue
+++ b/frontend/src/admin/AdminDialogs.vue
@@ -2,6 +2,7 @@
 import { computed } from 'vue'
 import Modal from '@/components/Modal.vue'
 import NameEditForm from '@/components/NameEditForm.vue'
+import { useAuthStore } from '@/stores/auth'
 
 const props = defineProps({
   dialog: Object,
@@ -9,11 +10,20 @@ const props = defineProps({
   settings: Object
 })
 
-const emit = defineEmits(['submitDialog', 'closeDialog'])
+const emit = defineEmits(['submitDialog', 'closeDialog', 'resetOidcSecret'])
 
 const NAME_EDIT_TYPES = new Set(['org-update', 'role-update', 'user-update-name'])
-const NO_SUBMIT_TYPES = new Set(['oidc-created'])
+const NO_SUBMIT_TYPES = new Set([])
 const rpId = computed(() => props.settings?.rp_id || 'the configured domain')
+const discoveryUrl = computed(() => `${window.location.origin}/.well-known/openid-configuration`)
+
+// Copy-to-clipboard helper
+const authStore = useAuthStore()
+function copyText(value, label) {
+  navigator.clipboard.writeText(value).then(() => {
+    authStore.showMessage(`${label} copied to clipboard`, 'success', 1500)
+  })
+}
 </script>
 
 <template>
@@ -26,9 +36,7 @@ const rpId = computed(() => props.settings?.rp_id || 'the configured domain')
         <template v-else-if="dialog.type==='user-create'">Add User To Role</template>
         <template v-else-if="dialog.type==='user-update-name'">Edit User Name</template>
         <template v-else-if="dialog.type==='perm-create' || dialog.type==='perm-display'">{{ dialog.type === 'perm-create' ? 'Create Permission' : 'Edit Permission' }}</template>
-        <template v-else-if="dialog.type==='oidc-create'">Create OIDC Client</template>
-        <template v-else-if="dialog.type==='oidc-edit'">Edit OIDC Client</template>
-        <template v-else-if="dialog.type==='oidc-created'">OIDC Client Created</template>
+        <template v-else-if="dialog.type==='oidc-edit'">{{ dialog.data?.isNew ? 'New OIDC Client' : 'OIDC Client' }}</template>
         <template v-else-if="dialog.type==='confirm'">Confirm</template>
       </h3>
       <form @submit.prevent="$emit('submitDialog')" class="modal-form">
@@ -84,30 +92,40 @@ const rpId = computed(() => props.settings?.rp_id || 'the configured domain')
           </label>
           <p class="small muted">E.g. yourapp:reports. Changing the scope name may break deployed applications.</p>
           <label>Domain Scope
-            <input v-model="dialog.data.domain" placeholder="e.g. app.example.com" data-form-type="other" />
+            <input v-model="dialog.data.domain" placeholder="e.g. app.example.com or OIDC client UUID" data-form-type="other" />
           </label>
-          <p class="small muted">If set, this permission is effective only on the specified domain, which can be {{ rpId }} or its subdomain.</p>
+          <p class="small muted">A domain ({{ rpId }} or subdomain) restricts this permission to that host. An OIDC client UUID sends it as a <em>groups</em> claim to that client.</p>
         </template>
-        <template v-else-if="dialog.type==='oidc-create' || dialog.type==='oidc-edit'">
+        <template v-else-if="dialog.type==='oidc-edit'">
           <label>Client Name
             <input v-model="dialog.data.name" placeholder="My Application" required />
           </label>
           <label>Redirect URIs (one per line)
-            <textarea v-model="dialog.data.redirect_uris" placeholder="https://example.com/callback&#10;https://app.example.com/auth/callback" rows="4" required></textarea>
+            <textarea v-model="dialog.data.redirect_uris" placeholder="https://example.com/callback&#10;https://app.example.com/auth/callback" rows="4"></textarea>
           </label>
           <p class="small muted">Enter the allowed callback URLs for this OIDC client, one per line.</p>
-        </template>
-        <template v-else-if="dialog.type==='oidc-created'">
-          <div class="oidc-success">
-            <p><strong>✅ OIDC Client Created Successfully!</strong></p>
-            <label>Client ID
-              <input v-model="dialog.data.client_id" readonly />
-            </label>
-            <label>Client Secret
-              <input v-model="dialog.data.client_secret" readonly />
-            </label>
-            <p><strong>⚠️ Important:</strong> Save the client secret now. It cannot be retrieved later!</p>
-          </div>
+
+          <template v-if="dialog.data.client_id">
+            <hr class="oidc-divider" />
+            <p class="small muted">Configure these in the remote application. Click a value to copy.</p>
+            <dl class="oidc-dl">
+              <dt>Client ID</dt>
+              <dd @click="copyText(dialog.data.client_id, 'Client ID')" title="Click to copy"><output>{{ dialog.data.client_id }}</output></dd>
+              <template v-if="dialog.data.client_secret">
+                <dt>Client Secret</dt>
+                <dd @click="copyText(dialog.data.client_secret, 'Client Secret')" title="Click to copy"><output>{{ dialog.data.client_secret }}</output></dd>
+              </template>
+              <dt>Discovery URL</dt>
+              <dd @click="copyText(discoveryUrl, 'Discovery URL')" title="Click to copy"><output>{{ discoveryUrl }}</output></dd>
+            </dl>
+            <p v-if="dialog.data.client_secret" class="small"><strong>⚠️ Save the secret now — it cannot be retrieved later.</strong></p>
+            <div v-else class="oidc-reset-row">
+              <button type="button" class="btn-secondary" @click="$emit('resetOidcSecret', dialog.data.client_id)">
+                🔄 Reset Client Secret
+              </button>
+              <span class="small muted">Generate a new secret (invalidates the current one)</span>
+            </div>
+          </template>
         </template>
         <template v-else-if="dialog.type==='confirm'">
           <p>{{ dialog.data.message }}</p>
@@ -145,6 +163,10 @@ const rpId = computed(() => props.settings?.rp_id || 'the configured domain')
 
 <style scoped>
 .optional { font-weight: normal; color: var(--color-text-muted); font-size: 0.85em; }
-.oidc-success { display: flex; flex-direction: column; gap: var(--space-md); }
-.oidc-success input { font-family: monospace; }
+.oidc-divider { border: none; border-top: 1px solid var(--color-border); margin: var(--space-sm) 0; }
+.oidc-dl { display: grid; grid-template-columns: auto 1fr; gap: 0.2rem 1rem; align-items: baseline; margin: 0; }
+.oidc-dl dt { font-size: 0.85rem; color: var(--color-text-muted); white-space: nowrap; }
+.oidc-dl dd { margin: 0; cursor: pointer; overflow: hidden; }
+.oidc-dl output { font-family: var(--font-mono, monospace); font-size: 0.85rem; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; display: block; }
+.oidc-reset-row { display: flex; align-items: center; gap: var(--space-sm); flex-wrap: wrap; }
 </style>
diff --git a/frontend/src/admin/AdminOverview.vue b/frontend/src/admin/AdminOverview.vue
index 43f9c4e..d320598 100644
--- a/frontend/src/admin/AdminOverview.vue
+++ b/frontend/src/admin/AdminOverview.vue
@@ -28,6 +28,17 @@ const sortedOrgs = computed(() => [...props.orgs].sort((a,b)=> {
   const nameCompare = a.display_name.localeCompare(b.display_name)
   return nameCompare !== 0 ? nameCompare : a.uuid.localeCompare(b.uuid)
 }))
+
+// Map OIDC client UUIDs to display names for permission domain column
+const oidcClientNames = computed(() => {
+  const map = {}
+  for (const c of props.oidcClients || []) map[c.uuid] = c.name
+  return map
+})
+function domainDisplay(domain) {
+  if (!domain) return '—'
+  return oidcClientNames.value[domain] || domain
+}
 const sortedPermissions = computed(() => [...props.permissions].sort((a,b)=> a.scope.localeCompare(b.scope)))
 
 // Derive admin status from permissions (info contains ctx from validate response)
@@ -343,7 +354,7 @@ defineExpose({ focusFirstElement })
                 <span class="id-text">{{ p.scope }}</span>
               </div>
             </td>
-            <td class="perm-domain">{{ p.domain || '—' }}</td>
+            <td class="perm-domain">{{ domainDisplay(p.domain) }}</td>
             <td class="perm-members center">{{ permissionSummary[p.uuid]?.userCount || 0 }}</td>
             <td class="perm-actions center">
               <button @click="$emit('deletePermission', p)" class="icon-btn delete-icon" aria-label="Delete permission" title="Delete permission">❌</button>
diff --git a/frontend/src/components/Modal.vue b/frontend/src/components/Modal.vue
index 9362c49..b197d6c 100644
--- a/frontend/src/components/Modal.vue
+++ b/frontend/src/components/Modal.vue
@@ -138,7 +138,8 @@ onUnmounted(() => {
 
 <style scoped>
 dialog {
-  background: var(--color-surface);
+  background: var(--color-dialog);
+  color: var(--color-text);
   border: 1px solid var(--color-border);
   border-radius: var(--radius-lg);
   box-shadow: var(--shadow-xl);
@@ -202,7 +203,7 @@ dialog :deep(.modal-form input:focus),
 dialog :deep(.modal-form textarea:focus) {
   outline: none;
   border-color: var(--color-accent);
-  box-shadow: 0 0 0 2px #c7d2fe;
+  box-shadow: var(--focus-ring);
 }
 
 dialog :deep(.modal-actions) {
diff --git a/paskia/db/__init__.py b/paskia/db/__init__.py
index 72628e3..1e6b3a5 100644
--- a/paskia/db/__init__.py
+++ b/paskia/db/__init__.py
@@ -52,6 +52,7 @@ from paskia.db.operations import (
     oidc_login,
     remove_permission_from_org,
     remove_permission_from_role,
+    reset_oid_client_secret,
     set_session_host,
     update_config,
     update_credential_sign_count,
@@ -149,5 +150,6 @@ __all__ = [
     # OIDC
     "create_oid_client",
     "update_oid_client",
+    "reset_oid_client_secret",
     "delete_oid_client",
 ]
diff --git a/paskia/db/operations.py b/paskia/db/operations.py
index a51e2f3..d50ae17 100644
--- a/paskia/db/operations.py
+++ b/paskia/db/operations.py
@@ -640,12 +640,31 @@ def update_oid_client(
             redirect_uris=redirect_uris
             if redirect_uris is not None
             else client.redirect_uris,
-            created_at=client.created_at,
         )
         updated_client.uuid = client.uuid
         _db.oid_clients[client_uuid] = updated_client
 
 
+def reset_oid_client_secret(
+    client_uuid: UUID,
+    new_secret_hash: bytes,
+    *,
+    ctx: SessionContext | None = None,
+) -> None:
+    """Reset an OIDC client's secret."""
+    if client_uuid not in _db.oid_clients:
+        raise ValueError(f"OIDC client {client_uuid} not found")
+    client = _db.oid_clients[client_uuid]
+    with _db.transaction("admin:reset_oid_client_secret", ctx):
+        updated = OIDClient(
+            client_secret_hash=new_secret_hash,
+            name=client.name,
+            redirect_uris=client.redirect_uris,
+        )
+        updated.uuid = client.uuid
+        _db.oid_clients[client_uuid] = updated
+
+
 def delete_oid_client(client_uuid: UUID, *, ctx: SessionContext | None = None) -> None:
     """Delete an OIDC client."""
     if client_uuid not in _db.oid_clients:
diff --git a/paskia/fastapi/admin.py b/paskia/fastapi/admin.py
index a411a55..a4acadb 100644
--- a/paskia/fastapi/admin.py
+++ b/paskia/fastapi/admin.py
@@ -1,3 +1,4 @@
+import hashlib
 import logging
 import secrets
 from uuid import UUID
@@ -731,14 +732,24 @@ async def admin_delete_user_session(
 
 
 def _validate_permission_domain(domain: str | None) -> None:
-    """Validate that domain is rp_id or a subdomain of it."""
+    """Validate that domain is rp_id, a subdomain of it, or an OIDC client UUID."""
     if domain is None:
         return
 
+    # Allow OIDC client UUIDs (used for groups claim)
+    try:
+        client_uuid = UUID(domain)
+        if client_uuid in db.data().oid_clients:
+            return
+    except ValueError:
+        pass
+
     rp_id = passkey.instance.rp_id
     if domain == rp_id or domain.endswith(f".{rp_id}"):
         return
-    raise ValueError(f"Domain '{domain}' must be '{rp_id}' or its subdomain")
+    raise ValueError(
+        f"Domain '{domain}' must be '{rp_id}', its subdomain, or an OIDC client UUID"
+    )
 
 
 def _check_admin_lockout(
@@ -979,10 +990,6 @@ async def admin_create_oidc_client(
     name = payload.get("name", "").strip()
     redirect_uris = payload.get("redirect_uris", [])
 
-    if not name:
-        raise ValueError("Client name is required")
-    if not redirect_uris:
-        raise ValueError("At least one redirect URI is required")
     if not isinstance(redirect_uris, list):
         raise ValueError("redirect_uris must be a list")
 
@@ -1040,8 +1047,8 @@ async def admin_update_oidc_client(
         raise ValueError("Client name cannot be empty")
 
     if redirect_uris is not None:
-        if not isinstance(redirect_uris, list) or not redirect_uris:
-            raise ValueError("At least one redirect URI is required")
+        if not isinstance(redirect_uris, list):
+            raise ValueError("redirect_uris must be a list")
         # Validate redirect URIs
         for uri in redirect_uris:
             if not isinstance(uri, str) or not uri.startswith("http"):
@@ -1057,6 +1064,42 @@ async def admin_update_oidc_client(
     return {"status": "ok"}
 
 
+@app.post("/oidc-clients/{client_uuid}/reset-secret")
+async def admin_reset_oidc_client_secret(
+    client_uuid: UUID,
+    request: Request,
+    auth=AUTH_COOKIE,
+):
+    """Reset an OIDC client's secret (master admin only)."""
+    ctx = await authz.verify(
+        auth,
+        ["auth:admin"],
+        host=request.headers.get("host"),
+        match=permutil.has_all,
+        max_age="5m",
+    )
+    if not master_admin(ctx):
+        raise authz.AuthException(
+            status_code=403,
+            detail="Only master admin can manage OIDC clients",
+            mode="forbidden",
+        )
+
+    client_secret = secrets.token_urlsafe(32)
+    secret_hash = hashlib.sha256(client_secret.encode()).digest()
+
+    try:
+        db.reset_oid_client_secret(client_uuid, secret_hash, ctx=ctx)
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e))
+
+    return {
+        "status": "ok",
+        "client_secret": client_secret,
+        "message": "Save the new client_secret now - it cannot be retrieved later",
+    }
+
+
 @app.delete("/oidc-clients/{client_uuid}")
 async def admin_delete_oidc_client(
     client_uuid: UUID,
diff --git a/paskia/fastapi/mainapp.py b/paskia/fastapi/mainapp.py
index 7b6a7b1..78615e6 100644
--- a/paskia/fastapi/mainapp.py
+++ b/paskia/fastapi/mainapp.py
@@ -124,7 +124,7 @@ async def openid_configuration(request: Request):
             "name",
             "preferred_username",
             "email",
-            "permissions",
+            "groups",
             "sid",
         ],
     }
diff --git a/paskia/fastapi/oid.py b/paskia/fastapi/oid.py
index 4c63c46..5336e22 100644
--- a/paskia/fastapi/oid.py
+++ b/paskia/fastapi/oid.py
@@ -327,17 +327,17 @@ def _build_token_response(
     """Build the token response with access_token, id_token, and refresh_token."""
     issuer = _get_issuer(request)
 
-    # Get user's permissions from role
+    # Get user's permissions scoped to this OIDC client (domain == client UUID)
     role = user.role
     org = role.org
     org_perm_uuids = {p.uuid for p in org.permissions}
-    permissions = []
+    groups = []
     for perm_uuid in role.permission_set:
         if perm_uuid not in org_perm_uuids:
             continue
         p = db.data().permissions.get(perm_uuid)
-        if p:
-            permissions.append(p.scope)
+        if p and p.domain == client_id:
+            groups.append(p.scope)
 
     # Get credential's last_used as auth_time
     auth_time = None
@@ -359,7 +359,7 @@ def _build_token_response(
         name=user.display_name,
         preferred_username=user.preferred_username,
         email=user.email,
-        groups=permissions if permissions else None,
+        groups=groups or None,
         auth_time=auth_time,
     )
 
@@ -426,17 +426,17 @@ async def userinfo(
     if not user:
         raise HTTPException(401, "User not found")
 
-    # Get user's permissions
+    # Get user's permissions scoped to this OIDC client (domain == client UUID)
     role = user.role
     org = role.org
     org_perm_uuids = {p.uuid for p in org.permissions}
-    permissions = []
+    groups = []
     for perm_uuid in role.permission_set:
         if perm_uuid not in org_perm_uuids:
             continue
         p = db.data().permissions.get(perm_uuid)
-        if p:
-            permissions.append(p.scope)
+        if p and p.domain == aud:
+            groups.append(p.scope)
 
     # Build userinfo response based on scope
     scope = payload.get("scope", "openid").split()
@@ -450,9 +450,9 @@ async def userinfo(
     if "email" in scope and user.email:
         response["email"] = user.email
 
-    # Always include permissions
-    if permissions:
-        response["permissions"] = permissions
+    # Include client-scoped permissions as groups
+    if groups:
+        response["groups"] = groups
 
     return response