---
title: "Register or rotate an OAuth client"
method: PUT
path: "/v1/integrations/oauth-clients/{provider}"
tags: ["integrations"]
---

# Register or rotate an OAuth client

`PUT /v1/integrations/oauth-clients/{provider}`

Point a connector at the organization's own OAuth client, or rotate its secrets.

## Path parameters

- `provider` 'google_drive' | 'gmail' | 'slack', required — The connector to configure

## Request body

- OAuthClientBody — Request body for registering or rotating an organization's own OAuth client. The secrets are :class:`SecretStr` so they are masked in reprs and in the input echo that pydantic attaches to validation errors; they are only ever read back inside a token exchange or a webhook signature check. Only the credentials are accepted -- the authorization and token endpoints stay pinned to Google's and Slack's own URLs, so a registered client can never redirect a token exchange elsewhere.
  - `client_id` string, required — The OAuth client ID from the customer's Google Cloud project or Slack app
  - `client_secret` string, password, required — The OAuth client secret. Write-only: it is encrypted at rest and never returned.
  - `signing_secret` string, password, nullable — The app's signing secret, used to verify the webhooks it sends. Required for Slack; not accepted for Google connectors. Write-only.
  - `return_url` string, nullable — Required. Where the connector's OAuth callback returns the user after consent. Must be an absolute https URL (http is allowed for localhost). The outcome is appended as query parameters: provider, status, and installation_id or error.

## Response `200`

The connector slot after the change

- OAuthClientMutationResponse — The result of registering, rotating, or removing a customer-owned Google OAuth client.
  - `data` OAuthClientMutationResult, required — The outcome of registering, rotating, or removing a customer-owned OAuth client.
    - `slot` OAuthClientSlot, required — One connector's bring-your-own-client slot, registered or not.
      - `provider` 'google_drive' | 'gmail' | 'slack', required — The connector this slot is for
      - `redirect_uri` string, required — The redirect URI that must be authorized on the customer's OAuth client
      - `required_scopes` string[], required — Scopes the customer's OAuth client must grant
      - `app_manifest` string, nullable — A JSON app manifest to create the customer's app from, for connectors that have one
      - `client` OAuthClientView — An organization's registered OAuth client as exposed to the dashboard. Secrets are never part of this shape: once stored they are only ever decrypted inside a token exchange or a webhook signature check. A client id is public by construction (it appears in the consent URL), so it is returned in full to let the customer confirm which app is wired up.
        - `provider` 'google_drive' | 'gmail' | 'slack', required — The connector this client is used for
        - `client_id` string, required — The customer's OAuth client id
        - `redirect_uri` string, required — The redirect URI that must be authorized on the customer's OAuth client
        - `return_url` string, nullable — Where the OAuth callback returns the user after consent, if the organization set one
        - `has_signing_secret` boolean — Whether a webhook signing secret is stored for the client (Slack only)
        - `created_by_user_id` string, nullable — The user who registered the client
        - `created_at` string, nullable — When the client was first registered
        - `updated_at` string, nullable — When the client was last rotated
    - `reauth_required_installation_ids` string[] — Installations whose refresh tokens were invalidated and now need reconnecting
    - `disconnected_installation_ids` string[] — Installations that were disconnected because the client they were authorized with was removed

## Other responses

- `422` — Validation Error

## Changes

- **2026-09-05** `ea8d85b8caca` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/mixedbread/apis/mxbai-omni/changes/v1/integrations/oauth-clients/:provider/put.md)

---

[API](https://skmtc.dev/mixedbread/apis/mxbai-omni.md) · [All operations](https://skmtc.dev/mixedbread/apis/mxbai-omni/llms.txt) · [OpenAPI document](https://skmtc.dev/mixedbread/apis/mxbai-omni/revisions/9c6c72afde2d?raw)