Instance Settings

Update OAuth application settings

Changed on

Updates the OAuth application settings for the instance.

patch/instance/oauth_application_settings

Request

  • Base URL: https://api.clerk.com/v1
  • URL: https://api.clerk.com/v1/instance/oauth_application_settings
  • Auth: HTTP bearer

Request body

dynamic_oauth_client_registrationboolean nullable

Whether dynamic OAuth client registration is enabled for the instance (RFC 7591).

dynamic_client_allowed_scopesstring[] nullable

Administrator-selected scope ceiling for dynamically registered and automatically admitted CIMD clients. Null preserves registered client limits; defaults must be a subset. Fresh user consent is required for expansion.

default_scopesstring[] nullable

Default scopes assigned when a dynamically registered or first-contact CIMD client omits scope. Accepts built-in keys and current custom catalog keys. advertised does not affect eligibility. Duplicate keys, unknown keys, and offline_access are rejected. An empty array or null resets to Clerk-provided defaults.

oauth_jwt_access_tokensboolean nullable

Whether OAuth JWT access tokens are enabled for the instance (disabled indicates opaque access tokens).

aud_claim_enabledboolean nullable

Whether OAuth access tokens can include an aud claim derived from the RFC 8707 resource parameter.

aud_claim_refresh_backfill_enabledboolean nullable

Whether refresh grants without a resource can adopt the requested resource when audience claims are enabled.

pkce_requiredboolean nullable

Whether all new OAuth authorization-code requests must use PKCE with the S256 challenge method.

client_id_metadata_documents_advertisedboolean nullable

Whether the instance advertises support for Client ID Metadata Documents in its OAuth authorization server metadata.

client_id_metadata_documents_only_allow_pre_registered_clientsboolean nullable

When true, new unknown CIMD clients are rejected. Previously auto-connected and pre-registered clients remain admitted; deleting a client makes it unknown again.

client_id_metadata_documents_block_implicitly_allowed_clientsboolean nullable

When true, recorded implicitly allowed CIMD clients are rejected on future client lookups. Explicitly allowed clients remain accepted. This does not revoke previously issued access tokens.

Response

Success

object'oauth_application_settings' required

String representing the object's type. Objects of the same type share the same value.

dynamic_oauth_client_registrationboolean required

Whether dynamic OAuth client registration is enabled for the instance (RFC 7591).

dynamic_client_allowed_scopesstring[] nullable

Administrator-selected scope ceiling for dynamically registered and automatically admitted CIMD clients. Null preserves registered client limits; defaults must be a subset. Fresh user consent is required for expansion.

default_scopesstring[] nullable required

Default scopes assigned when a dynamically registered or first-contact CIMD client omits scope. Contains built-in keys and custom catalog keys. Null means Clerk-provided defaults. advertised does not affect eligibility. An empty input array is stored and returned as null.

oauth_jwt_access_tokensboolean required

Whether OAuth JWT access tokens are enabled for the instance (disabled indicates opaque access tokens).

aud_claim_enabledboolean required

Whether OAuth access tokens can include an aud claim derived from the RFC 8707 resource parameter.

aud_claim_refresh_backfill_enabledboolean required

Whether refresh grants without a resource can adopt the requested resource when audience claims are enabled.

pkce_requiredboolean required

Whether all new OAuth authorization-code requests must use PKCE with the S256 challenge method.

client_id_metadata_documents_advertisedboolean required

Whether the instance advertises support for Client ID Metadata Documents in its OAuth authorization server metadata.

client_id_metadata_documents_only_allow_pre_registered_clientsboolean required

When true, new unknown CIMD clients are rejected. Previously auto-connected and pre-registered clients remain admitted; deleting a client makes it unknown again.

client_id_metadata_documents_block_implicitly_allowed_clientsboolean required

When true, recorded implicitly allowed CIMD clients are rejected on future client lookups. Explicitly allowed clients remain accepted. This does not revoke previously issued access tokens.

Changes

  • 2025-11-107db12d6a9b2aRevision changes
    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      added the optional property to the response with the status

    • info

      added the required property to the response with the status

  • 2025-11-10b5f30169c3f3Revision changes
    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      added the required property to the response with the status

    • info

      added the required property to the response with the status