---
title: "Update an OAuth client"
method: PATCH
path: "/orgs/{orgId}/oauth-clients/{clientId}"
tags: ["OAuth Client"]
---

# Update an OAuth client

`PATCH /orgs/{orgId}/oauth-clients/{clientId}`

## Request

- Base URL: `https://api.atlassian.com/admin/api-access/v1`
- URL: `https://api.atlassian.com/admin/api-access/v1/orgs/{orgId}/oauth-clients/{clientId}`
- Auth: none declared

Updates the name, token endpoint authentication method, or public keys of an
OAuth client in the specified organization. Omitted fields remain unchanged.
Supply `publicKeys` to replace the configured key set, including when rotating keys.
When switching to `private_key_jwt`, supply the public keys to use for authentication.
Private Key JWT must be enabled for your organization.

The response includes the supplied `keyId` when available. When explicitly switching
from `private_key_jwt` to a client-secret method (`basic`, `post`, `basic_pkce`, or
`post_pkce`), the response can include `clientSecret`. Save it securely at this point;
GET responses do not return it. Other updates return a null `clientSecret`.

#### Scopes
**[OAuth 2.0 scopes](/cloud/admin/scopes/) required:** `write:service-accounts-tokens:admin`

## Path parameters

- `orgId` string, required
- `clientId` string, required

## Request body

- UpdateOAuthClientRequest: Fields to update. Omitted fields remain unchanged.
  - `name` string: The new display name of the OAuth client.
  - `tokenEndpointAuthMethod` 'basic' | 'post' | 'basic_pkce' | 'post_pkce' | 'private_key_jwt': The new token endpoint authentication method, such as private_key_jwt or post.
  - `publicKeys` OAuthClientPublicKey[]: The replacement public key set. Omit to keep the existing keys.
    - `source` 'data_uri' | 'external_uri', required: The source of the public signing key.
    - `value` string, required: The public-key data URI or HTTPS JWKS URL.
    - `kid` string: Required for external_uri. For data_uri, embed this identifier in value instead.

## Response `200`

Returned if the OAuth client is successfully updated.

- OAuthClientUpdateResult: The OAuth client details returned after an update.
  - `clientId` string, required: The unique identifier of the OAuth client.
  - `name` string, required: The updated display name of the OAuth client.
  - `tokenEndpointAuthMethod` string, nullable: The resulting token endpoint authentication method.
  - `keyId` string, nullable: The first available key ID returned by the OAuth service, or null if unavailable. Not returned by GET endpoints.
  - `disabled` boolean, required: Whether the OAuth client is disabled.
  - `clientSecret` string, nullable: The client secret, when available, after an explicit switch from private_key_jwt to a client-secret authentication method. Null for other updates. Save it securely; GET endpoints do not return it.

## Other responses

- `400`: Returned if the request is invalid or Private Key JWT is not enabled for the organization.
- `403`: Returned if the user does not have permission to update OAuth clients.
- `404`: Returned if the OAuth client is not found in the organization.
- `500`: Internal Error

## Changes

- **2026-10-08** `52842bc49df9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/atlassian/apis/api-access/changes/orgs/:orgId/oauth-clients/:clientId/patch.md)

---

[API](https://skmtc.dev/atlassian/apis/api-access.md) - [All operations](https://skmtc.dev/atlassian/apis/api-access/llms.txt) - [OpenAPI document](https://skmtc.dev/atlassian/apis/api-access/revisions/52842bc49df9?raw)