--- title: Update OAuth Client --- [Skip to content](#%5Ftop) [API Reference](https://developers.cloudflare.com/api) [IAM](https://developers.cloudflare.com/api/resources/iam) [OAuth Clients](https://developers.cloudflare.com/api/resources/iam/subresources/oauth%5Fclients) Copy Markdown Open in **Claude** Open in **ChatGPT** Open in **Cursor** --- **Copy Markdown** **View as Markdown** # Update OAuth Client PATCH/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} Update an existing OAuth client. Only include fields you want to update. ##### Security API Token The preferred authorization scheme for interacting with the Cloudflare API. [Create a token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). **Example:**`Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY` API Email + API Key The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**`X-Auth-Email: user@example.com` The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**`X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194` ##### Accepted Permissions (at least one required) `OAuth Client Write` ##### Path ParametersExpand Collapse account\_id: string Account identifier tag. maxLength32 minLength32 oauth\_client\_id: string The unique identifier for an OAuth client. ##### Body ParametersJSONExpand Collapse allowed\_cors\_origins: optional array of string Array of allowed CORS origins. client\_name: optional string Human-readable name of the OAuth client. client\_uri: optional string URL of the home page of the client. grant\_types: optional array of "authorization\_code" or "refresh\_token" Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally. One of the following: "authorization\_code" "refresh\_token" logo\_uri: optional string URL of the client’s logo. optional\_scopes: optional array of string Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional. policy\_uri: optional string URL that points to a privacy policy document. post\_logout\_redirect\_uris: optional array of string Array of allowed post-logout redirect URIs. redirect\_uris: optional array of string Array of allowed redirect URIs for the client. response\_types: optional array of "token" or "id\_token" or "code" Array of OAuth response types the client is allowed to use. One of the following: "token" "id\_token" "code" scopes: optional array of string Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`. token\_endpoint\_auth\_method: optional "none" or "client\_secret\_basic" or "client\_secret\_post" The authentication method the client uses at the token endpoint. One of the following: "none" "client\_secret\_basic" "client\_secret\_post" tos\_uri: optional string URL that points to a terms of service document. visibility: optional "public" Promote the OAuth client from private to public visibility. Only `public` is accepted; demotion to `private` is not supported. Promotion requires a non-empty client name, logo URI, verified client URI host, and at least one non-identity scope. ##### ReturnsExpand Collapse errors: array of object { code, message, documentation\_url, source } code: number minimum1000 message: string documentation\_url: optional string source: optional object { pointer } pointer: optional string messages: array of object { code, message, documentation\_url, source } code: number minimum1000 message: string documentation\_url: optional string source: optional object { pointer } pointer: optional string success: true Whether the API call was successful. result: optional object { client\_id, visibility, allowed\_cors\_origins, 17 more } Fields shared by OAuth client responses and create/update requests. client\_id: string The unique identifier for an OAuth client. visibility: "public" or "private" Visibility of the OAuth client. One of the following: "public" "private" allowed\_cors\_origins: optional array of string Array of allowed CORS origins. client\_name: optional string Human-readable name of the OAuth client. client\_uri: optional string URL of the home page of the client. client\_uri\_verification: optional object { status, text } Client URI domain control verification state. status: optional "pending" or "in\_progress" or "verified" or "failed" Current verification status for the client URI host. One of the following: "pending" "in\_progress" "verified" "failed" text: optional string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. created\_at: optional string Timestamp when the OAuth client was created. formatdate-time grant\_types: optional array of "authorization\_code" or "refresh\_token" Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally. One of the following: "authorization\_code" "refresh\_token" has\_rotated\_secret: optional boolean Indicates whether the client has a rotated secret that has not yet been deleted. logo\_uri: optional string URL of the client’s logo. optional\_scopes: optional array of string Scopes that the authorizing user may decline during consent. Each value must also appear in `scopes`. The scopes `openid`, `offline`, and `offline_access` cannot be optional. policy\_uri: optional string URL that points to a privacy policy document. post\_logout\_redirect\_uris: optional array of string Array of allowed post-logout redirect URIs. promoted\_at: optional string Timestamp when the OAuth client was promoted to public visibility. formatdate-time redirect\_uris: optional array of string Array of allowed redirect URIs for the client. response\_types: optional array of "token" or "id\_token" or "code" Array of OAuth response types the client is allowed to use. One of the following: "token" "id\_token" "code" scopes: optional array of string Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`. token\_endpoint\_auth\_method: optional "none" or "client\_secret\_basic" or "client\_secret\_post" The authentication method the client uses at the token endpoint. One of the following: "none" "client\_secret\_basic" "client\_secret\_post" tos\_uri: optional string URL that points to a terms of service document. updated\_at: optional string Timestamp when the OAuth client was last updated. formatdate-time ### Update OAuth Client HTTP HTTPHTTP TypeScriptTypeScript PythonPython GoGo TerraformTerraform ``` curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/oauth_clients/$OAUTH_CLIENT_ID \ -X PATCH \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ -d '{ "allowed_cors_origins": [ "https://example.com" ], "client_name": "My OAuth App", "client_uri": "https://example.com", "grant_types": [ "authorization_code", "refresh_token" ], "logo_uri": "https://example.com/logo.png", "optional_scopes": [ "account.write" ], "policy_uri": "https://example.com/privacy", "post_logout_redirect_uris": [ "https://example.com/logout" ], "redirect_uris": [ "https://example.com/callback" ], "response_types": [ "code" ], "scopes": [ "account.read" ], "token_endpoint_auth_method": "client_secret_post", "tos_uri": "https://example.com/tos", "visibility": "public" }' ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "client_id": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4", "visibility": "private", "allowed_cors_origins": [ "https://example.com" ], "client_name": "My OAuth App", "client_uri": "https://example.com", "client_uri_verification": { "status": "in_progress", "text": "cloudflare_oauth_client_publisher=example" }, "created_at": "2025-01-01T00:00:00Z", "grant_types": [ "authorization_code", "refresh_token" ], "has_rotated_secret": false, "logo_uri": "https://example.com/logo.png", "optional_scopes": [ "account.write" ], "policy_uri": "https://example.com/privacy", "post_logout_redirect_uris": [ "https://example.com/logout" ], "promoted_at": "2026-05-13T12:00:00Z", "redirect_uris": [ "https://example.com/callback" ], "response_types": [ "code" ], "scopes": [ "account.read" ], "token_endpoint_auth_method": "client_secret_post", "tos_uri": "https://example.com/tos", "updated_at": "2025-01-01T00:00:00Z" } } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "client_id": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4", "visibility": "private", "allowed_cors_origins": [ "https://example.com" ], "client_name": "My OAuth App", "client_uri": "https://example.com", "client_uri_verification": { "status": "in_progress", "text": "cloudflare_oauth_client_publisher=example" }, "created_at": "2025-01-01T00:00:00Z", "grant_types": [ "authorization_code", "refresh_token" ], "has_rotated_secret": false, "logo_uri": "https://example.com/logo.png", "optional_scopes": [ "account.write" ], "policy_uri": "https://example.com/privacy", "post_logout_redirect_uris": [ "https://example.com/logout" ], "promoted_at": "2026-05-13T12:00:00Z", "redirect_uris": [ "https://example.com/callback" ], "response_types": [ "code" ], "scopes": [ "account.read" ], "token_endpoint_auth_method": "client_secret_post", "tos_uri": "https://example.com/tos", "updated_at": "2025-01-01T00:00:00Z" } } ```