GET
/instance/oauth_application_settingsGet OAuth application settings
Retrieves the settings for OAuth applications for the instance (dynamic client registration, JWT access tokens, etc.).
200Success
objectstringrequired
String representing the object's type. Objects of the same type share the same value.
dynamic_oauth_client_registrationbooleanrequired
Whether dynamic OAuth client registration is enabled for the instance (RFC 7591).
dynamic_client_allowed_scopesarray<string>optional
Administrator-selected scope ceiling for dynamically registered and automatically admitted CIMD clients. Null preserves registered client limits; defaults must be a subset. Fresh user consent is required for expansion.
default_scopesarray<string>required
Default scopes assigned when a dynamically registered or first-contact CIMD client omits `scope`. Contains built-in keys and custom catalog keys. Null means Clerk-provided defaults. `advertised` does not affect eligibility. An empty input array is stored and returned as null.
oauth_jwt_access_tokensbooleanrequired
Whether OAuth JWT access tokens are enabled for the instance (disabled indicates opaque access tokens).
aud_claim_enabledbooleanrequired
Whether OAuth access tokens can include an aud claim derived from the RFC 8707 resource parameter.
aud_claim_refresh_backfill_enabledbooleanrequired
Whether refresh grants without a resource can adopt the requested resource when audience claims are enabled.
pkce_requiredbooleanrequired
Whether all new OAuth authorization-code requests must use PKCE with the S256 challenge method.
client_id_metadata_documents_advertisedbooleanrequired
Whether the instance advertises support for Client ID Metadata Documents in its OAuth authorization server metadata.
client_id_metadata_documents_only_allow_pre_registered_clientsbooleanrequired
When true, new unknown CIMD clients are rejected. Previously auto-connected and pre-registered clients remain admitted; deleting a client makes it unknown again.
client_id_metadata_documents_block_implicitly_allowed_clientsbooleanrequired
When true, recorded implicitly allowed CIMD clients are rejected on future client lookups. Explicitly allowed clients remain accepted. This does not revoke previously issued access tokens.