---
title: "Replace an auth server client"
method: PUT
path: "/v1/auth-servers/{authServerId}/clients/{clientId}"
tags: ["Auth Server Clients"]
---

# Replace an auth server client

`PUT /v1/auth-servers/{authServerId}/clients/{clientId}`

Replace a client for a given auth server. The client ID and secret can be provided to update an existing client, or to create a client with the matching ID and secret.

## Request body

- object
  - `name` string, required — The name of the client
  - `client_secret` string, required — Secret of the client
  - `grant_types` GrantType[], required — List of OAuth 2.0 grant types
  - `response_types` ResponseType[], required — List of OAuth 2.0 response types
  - `redirect_uris` string[] — The URIs that the client is allowed to redirect to after authentication in interactive flows. All redirect URIs must be absolute URIs, be secure (HTTPS), and must not include a fragment component.
  - `login_uri` string, uri, nullable — The URI of the login page where the user is redirected to authenticate in interactive flows. The login page must be secure (HTTPS).
  - `access_token_duration` integer — The duration of the minted token is valid for, in seconds
  - `id_token_duration` integer — The duration of the minted token is valid for, in seconds
  - `refresh_token_duration` integer — The duration of the minted refresh token is valid for, in seconds
  - `allow_all_scopes` boolean — Specifies whether the client is allowed to request all scopes
  - `allow_scopes` string[] — Specifies the scopes IDs that the client is allowed to request
  - `token_endpoint_auth_method` 'client_secret_post' | 'none' — Requested authentication method for OAuth 2.0 endpoints.
  - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".

## Response `200`

A client

- Client
  - `id` string, required — The OAuth 2.0 client ID
  - `name` string, required — The name of the client
  - `grant_types` GrantType[], required — List of OAuth 2.0 grant types
  - `redirect_uris` string[], required — The URIs that the client is allowed to redirect to after authentication in interactive flows. All redirect URIs must be absolute URIs, be secure (HTTPS), and must not include a fragment component.
  - `login_uri` string, uri, nullable — The URI of the login page where the user is redirected to authenticate in interactive flows. The login page must be secure (HTTPS).
  - `access_token_duration` integer, required — The duration of the minted token is valid for, in seconds
  - `id_token_duration` integer, required — The duration of the minted token is valid for, in seconds
  - `refresh_token_duration` integer, required — The duration of the minted refresh token is valid for, in seconds
  - `allow_all_scopes` boolean, required — Specifies whether the client is allowed to request all scopes
  - `allow_scopes` string[], required — Specifies the scopes IDs that the client is allowed to request
  - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `response_types` ResponseType[], required — List of OAuth 2.0 response types
  - `token_endpoint_auth_method` 'client_secret_post' | 'none' — Requested authentication method for OAuth 2.0 endpoints.
  - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
  - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.

## Other responses

- `201` — A client
- `400` — Bad Request
- `404` — Not Found
- `409` — Conflict

## Changes

- **2026-03-04** `e425d5193d3e` — 2 warning, 4 info
  - added the new `refresh_token` enum value to the `grant_types/items/` response property for the response status `200`
  - added the new `refresh_token` enum value to the `grant_types/items/` response property for the response status `201`
  - added the new optional request property `refresh_token_duration`
  - added the new `refresh_token` enum value to the request property `grant_types/items/`
  - …2 more
- **2026-02-16** `106b373707f3` — 2 breaking
  - the response property `login_uri` became optional for the status `200`
  - the response property `login_uri` became optional for the status `201`
- **2025-11-06** `5d2b35832e3f` — 1 warning
  - added the new `type` enum value to the `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400`
- …earlier changes not shown

[Full history](https://skmtc.dev/kong/apis/konnect-api-beta/changes/v1/auth-servers/:authServerId/clients/:clientId/put.md)

---

[API](https://skmtc.dev/kong/apis/konnect-api-beta.md) · [All operations](https://skmtc.dev/kong/apis/konnect-api-beta/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kong/konnect-api-beta/revisions/658ffb748f95/schema)