---
title: OAuth Clients
---

[Skip to content](#%5Ftop) 

[API Reference](https://developers.cloudflare.com/api)

[IAM](https://developers.cloudflare.com/api/resources/iam)

Copy Markdown

Open in **Claude**

Open in **ChatGPT**

Open in **Cursor**

---

**Copy Markdown**

**View as Markdown**

# OAuth Clients

##### [List OAuth Clients](https://developers.cloudflare.com/api/resources/iam/subresources/oauth%5Fclients/methods/list)

GET/accounts/{account\_id}/oauth\_clients

##### [OAuth Client Details](https://developers.cloudflare.com/api/resources/iam/subresources/oauth%5Fclients/methods/get)

GET/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}

##### [Create OAuth Client](https://developers.cloudflare.com/api/resources/iam/subresources/oauth%5Fclients/methods/create)

POST/accounts/{account\_id}/oauth\_clients

##### [Update OAuth Client](https://developers.cloudflare.com/api/resources/iam/subresources/oauth%5Fclients/methods/update)

PATCH/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}

##### [Delete OAuth Client](https://developers.cloudflare.com/api/resources/iam/subresources/oauth%5Fclients/methods/delete)

DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}

##### [Rotate OAuth Client Secret](https://developers.cloudflare.com/api/resources/iam/subresources/oauth%5Fclients/methods/rotate%5Fsecret)

POST/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret

##### [Delete Rotated OAuth Client Secret](https://developers.cloudflare.com/api/resources/iam/subresources/oauth%5Fclients/methods/delete%5Frotated%5Fsecret)

DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret

##### ModelsExpand Collapse 

OAuthClientListResponse object { client\_id, visibility, allowed\_cors\_origins, 17 more } 

Fields shared by OAuth client responses and create/update requests.

client\_id: string

The unique identifier for an OAuth client.

visibility: "public" or "private"

Visibility of the OAuth client.

One of the following:

"public"

"private"

allowed\_cors\_origins: optional array of string

Array of allowed CORS origins.

client\_name: optional string

Human-readable name of the OAuth client.

client\_uri: optional string

URL of the home page of the client.

client\_uri\_verification: optional object { status, text } 

Client URI domain control verification state.

status: optional "pending" or "in\_progress" or "verified" or "failed"

Current verification status for the client URI host.

One of the following:

"pending"

"in\_progress"

"verified"

"failed"

text: optional string

Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

created\_at: optional string

Timestamp when the OAuth client was created.

formatdate-time

grant\_types: optional array of "authorization\_code" or "refresh\_token"

Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.

One of the following:

"authorization\_code"

"refresh\_token"

has\_rotated\_secret: optional boolean

Indicates whether the client has a rotated secret that has not yet been deleted.

logo\_uri: optional string

URL of the client’s logo.

optional\_scopes: optional array of string

Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional.

policy\_uri: optional string

URL that points to a privacy policy document.

post\_logout\_redirect\_uris: optional array of string

Array of allowed post-logout redirect URIs.

promoted\_at: optional string

Timestamp when the OAuth client was promoted to public visibility.

formatdate-time

redirect\_uris: optional array of string

Array of allowed redirect URIs for the client.

response\_types: optional array of "token" or "id\_token" or "code"

Array of OAuth response types the client is allowed to use.

One of the following:

"token"

"id\_token"

"code"

scopes: optional array of string

Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.

token\_endpoint\_auth\_method: optional "none" or "client\_secret\_basic" or "client\_secret\_post"

The authentication method the client uses at the token endpoint.

One of the following:

"none"

"client\_secret\_basic"

"client\_secret\_post"

tos\_uri: optional string

URL that points to a terms of service document.

updated\_at: optional string

Timestamp when the OAuth client was last updated.

formatdate-time

OAuthClientGetResponse object { client\_id, visibility, allowed\_cors\_origins, 17 more } 

Fields shared by OAuth client responses and create/update requests.

client\_id: string

The unique identifier for an OAuth client.

visibility: "public" or "private"

Visibility of the OAuth client.

One of the following:

"public"

"private"

allowed\_cors\_origins: optional array of string

Array of allowed CORS origins.

client\_name: optional string

Human-readable name of the OAuth client.

client\_uri: optional string

URL of the home page of the client.

client\_uri\_verification: optional object { status, text } 

Client URI domain control verification state.

status: optional "pending" or "in\_progress" or "verified" or "failed"

Current verification status for the client URI host.

One of the following:

"pending"

"in\_progress"

"verified"

"failed"

text: optional string

Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

created\_at: optional string

Timestamp when the OAuth client was created.

formatdate-time

grant\_types: optional array of "authorization\_code" or "refresh\_token"

Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.

One of the following:

"authorization\_code"

"refresh\_token"

has\_rotated\_secret: optional boolean

Indicates whether the client has a rotated secret that has not yet been deleted.

logo\_uri: optional string

URL of the client’s logo.

optional\_scopes: optional array of string

Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional.

policy\_uri: optional string

URL that points to a privacy policy document.

post\_logout\_redirect\_uris: optional array of string

Array of allowed post-logout redirect URIs.

promoted\_at: optional string

Timestamp when the OAuth client was promoted to public visibility.

formatdate-time

redirect\_uris: optional array of string

Array of allowed redirect URIs for the client.

response\_types: optional array of "token" or "id\_token" or "code"

Array of OAuth response types the client is allowed to use.

One of the following:

"token"

"id\_token"

"code"

scopes: optional array of string

Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.

token\_endpoint\_auth\_method: optional "none" or "client\_secret\_basic" or "client\_secret\_post"

The authentication method the client uses at the token endpoint.

One of the following:

"none"

"client\_secret\_basic"

"client\_secret\_post"

tos\_uri: optional string

URL that points to a terms of service document.

updated\_at: optional string

Timestamp when the OAuth client was last updated.

formatdate-time

OAuthClientCreateResponse object { client\_id, visibility, allowed\_cors\_origins, 18 more } 

Fields shared by OAuth client responses and create/update requests.

client\_id: string

The unique identifier for an OAuth client.

visibility: "public" or "private"

Visibility of the OAuth client.

One of the following:

"public"

"private"

allowed\_cors\_origins: optional array of string

Array of allowed CORS origins.

client\_name: optional string

Human-readable name of the OAuth client.

client\_secret: optional string

The client secret. This is the only time the secret is returned in a response.

client\_uri: optional string

URL of the home page of the client.

client\_uri\_verification: optional object { status, text } 

Client URI domain control verification state.

status: optional "pending" or "in\_progress" or "verified" or "failed"

Current verification status for the client URI host.

One of the following:

"pending"

"in\_progress"

"verified"

"failed"

text: optional string

Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

created\_at: optional string

Timestamp when the OAuth client was created.

formatdate-time

grant\_types: optional array of "authorization\_code" or "refresh\_token"

Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.

One of the following:

"authorization\_code"

"refresh\_token"

has\_rotated\_secret: optional boolean

Indicates whether the client has a rotated secret that has not yet been deleted.

logo\_uri: optional string

URL of the client’s logo.

optional\_scopes: optional array of string

Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional.

policy\_uri: optional string

URL that points to a privacy policy document.

post\_logout\_redirect\_uris: optional array of string

Array of allowed post-logout redirect URIs.

promoted\_at: optional string

Timestamp when the OAuth client was promoted to public visibility.

formatdate-time

redirect\_uris: optional array of string

Array of allowed redirect URIs for the client.

response\_types: optional array of "token" or "id\_token" or "code"

Array of OAuth response types the client is allowed to use.

One of the following:

"token"

"id\_token"

"code"

scopes: optional array of string

Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.

token\_endpoint\_auth\_method: optional "none" or "client\_secret\_basic" or "client\_secret\_post"

The authentication method the client uses at the token endpoint.

One of the following:

"none"

"client\_secret\_basic"

"client\_secret\_post"

tos\_uri: optional string

URL that points to a terms of service document.

updated\_at: optional string

Timestamp when the OAuth client was last updated.

formatdate-time

OAuthClientUpdateResponse object { client\_id, visibility, allowed\_cors\_origins, 17 more } 

Fields shared by OAuth client responses and create/update requests.

client\_id: string

The unique identifier for an OAuth client.

visibility: "public" or "private"

Visibility of the OAuth client.

One of the following:

"public"

"private"

allowed\_cors\_origins: optional array of string

Array of allowed CORS origins.

client\_name: optional string

Human-readable name of the OAuth client.

client\_uri: optional string

URL of the home page of the client.

client\_uri\_verification: optional object { status, text } 

Client URI domain control verification state.

status: optional "pending" or "in\_progress" or "verified" or "failed"

Current verification status for the client URI host.

One of the following:

"pending"

"in\_progress"

"verified"

"failed"

text: optional string

Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

created\_at: optional string

Timestamp when the OAuth client was created.

formatdate-time

grant\_types: optional array of "authorization\_code" or "refresh\_token"

Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.

One of the following:

"authorization\_code"

"refresh\_token"

has\_rotated\_secret: optional boolean

Indicates whether the client has a rotated secret that has not yet been deleted.

logo\_uri: optional string

URL of the client’s logo.

optional\_scopes: optional array of string

Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional.

policy\_uri: optional string

URL that points to a privacy policy document.

post\_logout\_redirect\_uris: optional array of string

Array of allowed post-logout redirect URIs.

promoted\_at: optional string

Timestamp when the OAuth client was promoted to public visibility.

formatdate-time

redirect\_uris: optional array of string

Array of allowed redirect URIs for the client.

response\_types: optional array of "token" or "id\_token" or "code"

Array of OAuth response types the client is allowed to use.

One of the following:

"token"

"id\_token"

"code"

scopes: optional array of string

Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.

token\_endpoint\_auth\_method: optional "none" or "client\_secret\_basic" or "client\_secret\_post"

The authentication method the client uses at the token endpoint.

One of the following:

"none"

"client\_secret\_basic"

"client\_secret\_post"

tos\_uri: optional string

URL that points to a terms of service document.

updated\_at: optional string

Timestamp when the OAuth client was last updated.

formatdate-time

OAuthClientDeleteResponse object { id } 

id: string

Identifier

maxLength32

minLength32

OAuthClientRotateSecretResponse object { client\_secret } 

client\_secret: optional string

The new client secret.

OAuthClientDeleteRotatedSecretResponse object { id } 

id: string

Identifier

maxLength32

minLength32