--- title: OAuth Clients --- [Skip to content](#%5Ftop) [API Reference](https://developers.cloudflare.com/api/python) [IAM](https://developers.cloudflare.com/api/python/resources/iam) Copy Markdown Open in **Claude** Open in **ChatGPT** Open in **Cursor** --- **Copy Markdown** **View as Markdown** # OAuth Clients ##### [List OAuth Clients](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth%5Fclients/methods/list) iam.oauth\_clients.list(OAuthClientListParams\*\*kwargs) \-> SyncSinglePage\[[OAuthClientListResponse](https://developers.cloudflare.com/api/python/resources/iam#%28resource%29%20iam.oauth%5Fclients%20%3E%20%28model%29%20oauth%5Fclient%5Flist%5Fresponse%20%3E%20%28schema%29)\] GET/accounts/{account\_id}/oauth\_clients ##### [OAuth Client Details](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth%5Fclients/methods/get) iam.oauth\_clients.get(stroauth\_client\_id, OAuthClientGetParams\*\*kwargs) \-> [OAuthClientGetResponse](https://developers.cloudflare.com/api/python/resources/iam#%28resource%29%20iam.oauth%5Fclients%20%3E%20%28model%29%20oauth%5Fclient%5Fget%5Fresponse%20%3E%20%28schema%29) GET/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Create OAuth Client](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth%5Fclients/methods/create) iam.oauth\_clients.create(OAuthClientCreateParams\*\*kwargs) \-> [OAuthClientCreateResponse](https://developers.cloudflare.com/api/python/resources/iam#%28resource%29%20iam.oauth%5Fclients%20%3E%20%28model%29%20oauth%5Fclient%5Fcreate%5Fresponse%20%3E%20%28schema%29) POST/accounts/{account\_id}/oauth\_clients ##### [Update OAuth Client](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth%5Fclients/methods/update) iam.oauth\_clients.update(stroauth\_client\_id, OAuthClientUpdateParams\*\*kwargs) \-> [OAuthClientUpdateResponse](https://developers.cloudflare.com/api/python/resources/iam#%28resource%29%20iam.oauth%5Fclients%20%3E%20%28model%29%20oauth%5Fclient%5Fupdate%5Fresponse%20%3E%20%28schema%29) PATCH/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Delete OAuth Client](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth%5Fclients/methods/delete) iam.oauth\_clients.delete(stroauth\_client\_id, OAuthClientDeleteParams\*\*kwargs) \-> [OAuthClientDeleteResponse](https://developers.cloudflare.com/api/python/resources/iam#%28resource%29%20iam.oauth%5Fclients%20%3E%20%28model%29%20oauth%5Fclient%5Fdelete%5Fresponse%20%3E%20%28schema%29) DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Rotate OAuth Client Secret](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth%5Fclients/methods/rotate%5Fsecret) iam.oauth\_clients.rotate\_secret(stroauth\_client\_id, OAuthClientRotateSecretParams\*\*kwargs) \-> [OAuthClientRotateSecretResponse](https://developers.cloudflare.com/api/python/resources/iam#%28resource%29%20iam.oauth%5Fclients%20%3E%20%28model%29%20oauth%5Fclient%5Frotate%5Fsecret%5Fresponse%20%3E%20%28schema%29) POST/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### [Delete Rotated OAuth Client Secret](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth%5Fclients/methods/delete%5Frotated%5Fsecret) iam.oauth\_clients.delete\_rotated\_secret(stroauth\_client\_id, OAuthClientDeleteRotatedSecretParams\*\*kwargs) \-> [OAuthClientDeleteRotatedSecretResponse](https://developers.cloudflare.com/api/python/resources/iam#%28resource%29%20iam.oauth%5Fclients%20%3E%20%28model%29%20oauth%5Fclient%5Fdelete%5Frotated%5Fsecret%5Fresponse%20%3E%20%28schema%29) DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### ModelsExpand Collapse class OAuthClientListResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. visibility: Literal\["public", "private"\] Visibility of the OAuth client. One of the following: "public" "private" allowed\_cors\_origins: Optional\[List\[str\]\] Array of allowed CORS origins. client\_name: Optional\[str\] Human-readable name of the OAuth client. client\_uri: Optional\[str\] URL of the home page of the client. client\_uri\_verification: Optional\[ClientURIVerification\] Client URI domain control verification state. status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"\]\] Current verification status for the client URI host. One of the following: "pending" "in\_progress" "verified" "failed" text: Optional\[str\] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. created\_at: Optional\[datetime\] Timestamp when the OAuth client was created. formatdate-time grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"\]\]\] Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally. One of the following: "authorization\_code" "refresh\_token" has\_rotated\_secret: Optional\[bool\] Indicates whether the client has a rotated secret that has not yet been deleted. logo\_uri: Optional\[str\] URL of the client’s logo. optional\_scopes: Optional\[List\[str\]\] Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional. policy\_uri: Optional\[str\] URL that points to a privacy policy document. post\_logout\_redirect\_uris: Optional\[List\[str\]\] Array of allowed post-logout redirect URIs. promoted\_at: Optional\[datetime\] Timestamp when the OAuth client was promoted to public visibility. formatdate-time redirect\_uris: Optional\[List\[str\]\] Array of allowed redirect URIs for the client. response\_types: Optional\[List\[Literal\["token", "id\_token", "code"\]\]\] Array of OAuth response types the client is allowed to use. One of the following: "token" "id\_token" "code" scopes: Optional\[List\[str\]\] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`. token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"\]\] The authentication method the client uses at the token endpoint. One of the following: "none" "client\_secret\_basic" "client\_secret\_post" tos\_uri: Optional\[str\] URL that points to a terms of service document. updated\_at: Optional\[datetime\] Timestamp when the OAuth client was last updated. formatdate-time class OAuthClientGetResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. visibility: Literal\["public", "private"\] Visibility of the OAuth client. One of the following: "public" "private" allowed\_cors\_origins: Optional\[List\[str\]\] Array of allowed CORS origins. client\_name: Optional\[str\] Human-readable name of the OAuth client. client\_uri: Optional\[str\] URL of the home page of the client. client\_uri\_verification: Optional\[ClientURIVerification\] Client URI domain control verification state. status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"\]\] Current verification status for the client URI host. One of the following: "pending" "in\_progress" "verified" "failed" text: Optional\[str\] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. created\_at: Optional\[datetime\] Timestamp when the OAuth client was created. formatdate-time grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"\]\]\] Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally. One of the following: "authorization\_code" "refresh\_token" has\_rotated\_secret: Optional\[bool\] Indicates whether the client has a rotated secret that has not yet been deleted. logo\_uri: Optional\[str\] URL of the client’s logo. optional\_scopes: Optional\[List\[str\]\] Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional. policy\_uri: Optional\[str\] URL that points to a privacy policy document. post\_logout\_redirect\_uris: Optional\[List\[str\]\] Array of allowed post-logout redirect URIs. promoted\_at: Optional\[datetime\] Timestamp when the OAuth client was promoted to public visibility. formatdate-time redirect\_uris: Optional\[List\[str\]\] Array of allowed redirect URIs for the client. response\_types: Optional\[List\[Literal\["token", "id\_token", "code"\]\]\] Array of OAuth response types the client is allowed to use. One of the following: "token" "id\_token" "code" scopes: Optional\[List\[str\]\] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`. token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"\]\] The authentication method the client uses at the token endpoint. One of the following: "none" "client\_secret\_basic" "client\_secret\_post" tos\_uri: Optional\[str\] URL that points to a terms of service document. updated\_at: Optional\[datetime\] Timestamp when the OAuth client was last updated. formatdate-time class OAuthClientCreateResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. visibility: Literal\["public", "private"\] Visibility of the OAuth client. One of the following: "public" "private" allowed\_cors\_origins: Optional\[List\[str\]\] Array of allowed CORS origins. client\_name: Optional\[str\] Human-readable name of the OAuth client. client\_secret: Optional\[str\] The client secret. This is the only time the secret is returned in a response. client\_uri: Optional\[str\] URL of the home page of the client. client\_uri\_verification: Optional\[ClientURIVerification\] Client URI domain control verification state. status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"\]\] Current verification status for the client URI host. One of the following: "pending" "in\_progress" "verified" "failed" text: Optional\[str\] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. created\_at: Optional\[datetime\] Timestamp when the OAuth client was created. formatdate-time grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"\]\]\] Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally. One of the following: "authorization\_code" "refresh\_token" has\_rotated\_secret: Optional\[bool\] Indicates whether the client has a rotated secret that has not yet been deleted. logo\_uri: Optional\[str\] URL of the client’s logo. optional\_scopes: Optional\[List\[str\]\] Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional. policy\_uri: Optional\[str\] URL that points to a privacy policy document. post\_logout\_redirect\_uris: Optional\[List\[str\]\] Array of allowed post-logout redirect URIs. promoted\_at: Optional\[datetime\] Timestamp when the OAuth client was promoted to public visibility. formatdate-time redirect\_uris: Optional\[List\[str\]\] Array of allowed redirect URIs for the client. response\_types: Optional\[List\[Literal\["token", "id\_token", "code"\]\]\] Array of OAuth response types the client is allowed to use. One of the following: "token" "id\_token" "code" scopes: Optional\[List\[str\]\] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`. token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"\]\] The authentication method the client uses at the token endpoint. One of the following: "none" "client\_secret\_basic" "client\_secret\_post" tos\_uri: Optional\[str\] URL that points to a terms of service document. updated\_at: Optional\[datetime\] Timestamp when the OAuth client was last updated. formatdate-time class OAuthClientUpdateResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. visibility: Literal\["public", "private"\] Visibility of the OAuth client. One of the following: "public" "private" allowed\_cors\_origins: Optional\[List\[str\]\] Array of allowed CORS origins. client\_name: Optional\[str\] Human-readable name of the OAuth client. client\_uri: Optional\[str\] URL of the home page of the client. client\_uri\_verification: Optional\[ClientURIVerification\] Client URI domain control verification state. status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"\]\] Current verification status for the client URI host. One of the following: "pending" "in\_progress" "verified" "failed" text: Optional\[str\] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. created\_at: Optional\[datetime\] Timestamp when the OAuth client was created. formatdate-time grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"\]\]\] Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally. One of the following: "authorization\_code" "refresh\_token" has\_rotated\_secret: Optional\[bool\] Indicates whether the client has a rotated secret that has not yet been deleted. logo\_uri: Optional\[str\] URL of the client’s logo. optional\_scopes: Optional\[List\[str\]\] Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional. policy\_uri: Optional\[str\] URL that points to a privacy policy document. post\_logout\_redirect\_uris: Optional\[List\[str\]\] Array of allowed post-logout redirect URIs. promoted\_at: Optional\[datetime\] Timestamp when the OAuth client was promoted to public visibility. formatdate-time redirect\_uris: Optional\[List\[str\]\] Array of allowed redirect URIs for the client. response\_types: Optional\[List\[Literal\["token", "id\_token", "code"\]\]\] Array of OAuth response types the client is allowed to use. One of the following: "token" "id\_token" "code" scopes: Optional\[List\[str\]\] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`. token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"\]\] The authentication method the client uses at the token endpoint. One of the following: "none" "client\_secret\_basic" "client\_secret\_post" tos\_uri: Optional\[str\] URL that points to a terms of service document. updated\_at: Optional\[datetime\] Timestamp when the OAuth client was last updated. formatdate-time class OAuthClientDeleteResponse: … id: str Identifier maxLength32 minLength32 class OAuthClientRotateSecretResponse: … client\_secret: Optional\[str\] The new client secret. class OAuthClientDeleteRotatedSecretResponse: … id: str Identifier maxLength32 minLength32