Instance Settings

Get OAuth application settings

Changed on

Retrieves the settings for OAuth applications for the instance (dynamic client registration, JWT access tokens, etc.).

get/instance/oauth_application_settings

Request

  • Base URL: https://api.clerk.com/v1
  • URL: https://api.clerk.com/v1/instance/oauth_application_settings
  • Auth: HTTP bearer

Response

Success

object'oauth_application_settings' required

String representing the object's type. Objects of the same type share the same value.

dynamic_oauth_client_registrationboolean required

Whether dynamic OAuth client registration is enabled for the instance (RFC 7591).

dynamic_client_allowed_scopesstring[] nullable

Administrator-selected scope ceiling for dynamically registered and automatically admitted CIMD clients. Null preserves registered client limits; defaults must be a subset. Fresh user consent is required for expansion.

default_scopesstring[] nullable required

Default scopes assigned when a dynamically registered or first-contact CIMD client omits scope. Contains built-in keys and custom catalog keys. Null means Clerk-provided defaults. advertised does not affect eligibility. An empty input array is stored and returned as null.

oauth_jwt_access_tokensboolean required

Whether OAuth JWT access tokens are enabled for the instance (disabled indicates opaque access tokens).

aud_claim_enabledboolean required

Whether OAuth access tokens can include an aud claim derived from the RFC 8707 resource parameter.

aud_claim_refresh_backfill_enabledboolean required

Whether refresh grants without a resource can adopt the requested resource when audience claims are enabled.

pkce_requiredboolean required

Whether all new OAuth authorization-code requests must use PKCE with the S256 challenge method.

client_id_metadata_documents_advertisedboolean required

Whether the instance advertises support for Client ID Metadata Documents in its OAuth authorization server metadata.

client_id_metadata_documents_only_allow_pre_registered_clientsboolean required

When true, new unknown CIMD clients are rejected. Previously auto-connected and pre-registered clients remain admitted; deleting a client makes it unknown again.

client_id_metadata_documents_block_implicitly_allowed_clientsboolean required

When true, recorded implicitly allowed CIMD clients are rejected on future client lookups. Explicitly allowed clients remain accepted. This does not revoke previously issued access tokens.

Changes

  • 2025-11-107db12d6a9b2aRevision changes
    • info

      added the optional property to the response with the status

    • info

      added the required property to the response with the status

  • 2025-11-10b5f30169c3f3Revision changes
    • info

      added the required property to the response with the status

    • info

      added the required property to the response with the status