ATatlassian
OAuth Client

Update an OAuth client

Changed on

Updates the name, token endpoint authentication method, or public keys of an OAuth client in the specified organization. Omitted fields remain unchanged. Supply publicKeys to replace the configured key set, including when rotating keys. When switching to private_key_jwt, supply the public keys to use for authentication. Private Key JWT must be enabled for your organization.

The response includes the supplied keyId when available. When explicitly switching from private_key_jwt to a client-secret method (basic, post, basic_pkce, or post_pkce), the response can include clientSecret. Save it securely at this point; GET responses do not return it. Other updates return a null clientSecret.

Scopes

OAuth 2.0 scopes required: write:service-accounts-tokens:admin

patch/orgs/{orgId}/oauth-clients/{clientId}

Request

  • Base URL
    https://api.atlassian.com/admin/api-access/v1
  • URL
    https://api.atlassian.com/admin/api-access/v1/orgs/{orgId}/oauth-clients/{clientId}
  • Auth
    none declared

Path parameters

orgIdstring required

The unique identifier of your organization.

clientIdstring required

The unique identifier of the OAuth client to update.

Request body

namestring

The new display name of the OAuth client.

tokenEndpointAuthMethod'basic' | 'post' | 'basic_pkce' | 'post_pkce' | 'private_key_jwt'

The new token endpoint authentication method, such as private_key_jwt or post.

Example request

{
  "tokenEndpointAuthMethod": "private_key_jwt",
  "publicKeys": [
    {
      "value": "https://auth.example.com/.well-known/jwks.json",
      "kid": "client-key-2026-01"
    }
  ]
}

Response

Returned if the OAuth client is successfully updated.

clientIdstring required

The unique identifier of the OAuth client.

namestring required

The updated display name of the OAuth client.

tokenEndpointAuthMethodstring nullable

The resulting token endpoint authentication method.

keyIdstring nullable

The first available key ID returned by the OAuth service, or null if unavailable. Not returned by GET endpoints.

disabledboolean required

Whether the OAuth client is disabled.

clientSecretstring nullable

The client secret, when available, after an explicit switch from private_key_jwt to a client-secret authentication method. Null for other updates. Save it securely; GET endpoints do not return it.

Changes