Clerk API (unofficial showcase)
PATCH/oauth_applications/{oauth_application_id}

Update an OAuth application

Updates an existing OAuth application with the properties you provide. Use scopes to replace the application's complete built-in and custom scope ceiling, rather than adding individual scopes. Include required built-in scopes and use custom scope keys from the instance OAuth scope catalog.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

1 parameter · 11 body fields
oauth_application_idstringrequired
The ID of the OAuth application to update.

OAuth application properties to update; provide only the fields you want to change.

namestringoptional
The new name of the OAuth application. Max length: 256
redirect_urisarray<string>optional
An array of redirect URIs of the new OAuth application
callback_urlstringdeprecatedoptional
The new callback URL of the OAuth application
scopesstringoptional
Replace the application's complete built-in and custom scope ceiling. Provide scope keys as a space-delimited string. Custom keys must exist in the instance OAuth scope catalog. Required built-in scopes, such as `offline_access`, must be included in the replacement set, otherwise the request is rejected. Omit this field to leave all scope assignments unchanged.
consent_screen_enabledbooleanoptional
True to enable a consent screen to display in the authentication flow. This cannot be disabled for dynamically registered OAuth Applications.
pkce_requiredbooleanoptional
True to require the Proof Key of Code Exchange (PKCE) flow.
audience_uristringoptional
An absolute resource URI for a confidential application (RFC 8707 section 2). Registers a resource with no accepted scopes, or adopts an unowned resource with confirmation. Every claimed URI remains permanently reserved to this app, including retirement and deletion, and counts toward the instance resource quota. Changing it stops new exchanges from the old audience immediately. Already-issued tokens retain their lifetime. Clearing requires exchange disabled in an earlier update.
token_exchange_enabledbooleanoptional
Enable exchanges from the active audience. Requires an audience URI. Disabling preserves target configuration.
adopt_audience_resourcebooleanoptional
Confirm adoption of an existing unowned resource, preserving its accepted scopes and target references. Does not override another application's reservation.
device_authorization_grant_enabledbooleanoptional
True to enable the OAuth Device Authorization Grant for this application. Enabling requires the new OAuth IdP and a reachable device verification page. Omit this field to leave the setting unchanged.
publicbooleanoptional
If true, this client is public and you can use the Proof Key of Code Exchange (PKCE) flow.

5 status codes
200Returns the updated OAuth application, including its identifiers, configuration, audience URI, and scope ceiling.
objectstringrequired
Allowed:oauth_application
idstringrequired
instance_idstringrequired
namestringrequired
client_idstringrequired
client_uristringrequired
client_image_urlstringrequired
dynamically_registeredbooleanrequired
consent_screen_enabledbooleanrequired
pkce_requiredbooleanrequired
audience_uristringrequired
The active application audience URI, whose registry identity is permanently reserved to this application.
token_exchange_enabledbooleanrequired
Whether this confidential application accepts token exchanges from its active audience.
device_authorization_grant_enabledbooleanrequired
publicbooleanrequired
scopesstringrequired
The complete scope ceiling for the OAuth application, as a space-delimited list of built-in and assigned custom scope keys.
redirect_urisarray<string>required
callback_urlstringdeprecatedrequired
Deprecated: Use redirect_uris instead.
authorize_urlstringrequired
token_fetch_urlstringrequired
user_info_urlstringrequired
discovery_urlstringrequired
token_introspection_urlstringrequired
created_atintegerrequired
Unix timestamp of creation.
updated_atintegerrequired
Unix timestamp of last update.
400Returned when the request is not successful.
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional
403Returned when authorization is invalid.
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional
404Returned when the OAuth application cannot be found.
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional
422Returned when request parameters are invalid.
errorsarray<object>required
metaobjectoptional
clerk_trace_idstringoptional

Error handling

A 400 is returned when the request is not successful. A 403 is returned when authorization is invalid. A 404 is returned when the OAuth application cannot be found. A 422 is returned when request parameters are invalid. The oauth_application_id path parameter must identify an existing OAuth application. name must not exceed 256 characters; callback_url and scopes must not exceed 1024 characters. Provide scopes as a space-delimited string, include required built-in scopes such as offline_access, and use custom keys from the instance OAuth scope catalog. audience_uri must be an absolute resource URI, and enabling token_exchange_enabled requires an audience URI. Enabling device_authorization_grant_enabled requires the new OAuth IdP and a reachable device verification page.