Techniques are described for management of authorization (e.g., OAuth) clients on a distributed computing environment (e.g., platform), through a deployment descriptor of the application(s) hosted in the environment. The deployment descriptor can be provided with the deployed application, and describes various permissions for access to services provided by the platform and scope(s) of such access. Credentials can be generated for each subscriber of the application, according to the scope(s) indicated in the descriptor, and an authorization client can be generated that describes the various subscriptions of the various access and access scope(s) associated with each subscription. The authorization client is available on the platform and accessed at application runtime to control the application's access to the various services available on the platform.