---
title: "Update authentication configuration"
method: PUT
path: "/connectors/{connectorId}/config/auth"
tags: ["Connector Configuration"]
---

# Update authentication configuration

`PUT /connectors/{connectorId}/config/auth`

## Request

- Base URL: `https://app.pipeshub.com/api/v1`
- URL: `https://app.pipeshub.com/api/v1/connectors/{connectorId}/config/auth`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Authorization code: `/api/v1/oauth2/authorize`
    - Client credentials
    - Token URL: `/api/v1/oauth2/token` scopes: `connector:write`

Update only the authentication configuration.<br><br>
<b>Use Case:</b><br>
Use this when you need to update credentials without changing
sync or filter settings. Useful for credential rotation.<br><br>
<b>Prerequisites:</b><br>
Connector must be disabled. This endpoint clears OAuth state,
requiring re-authentication for OAuth connectors.<br><br>
<b>Secrets:</b><br>
A secret field sent as <code>••••••••</code> keeps the stored value; send a
new value to replace it. The response masks stored secrets the same way.

## Path parameters

- `connectorId` string, required

## Request body

- UpdateConnectorAuthRequest
  - `auth` ConnectorAuthConfig, required: Auth settings, flat: send each field listed under `auth.schemas.<authType>.fields` in GET /connectors/registry/{connectorType}/schema by its `name`. For OAuth, an admin may send the OAuth app's credentials here (the app is saved and linked), or anyone may send `oauthConfigId` to use a saved app.
    - `oauthConfigId` string: A saved OAuth app (GET /oauth/{connectorType})
    - `oauthInstanceName` string: Name for the OAuth app saved from inline credentials
    - `connectorScope` string: Scope of the instance, as the frontend sends it; the server fills it in when absent
    - `authType` string: On `PUT /connectors/{connectorId}/config` only: must equal the instance's `authType`, which cannot be changed (`400` otherwise).
  - `baseUrl` string: Recomputes the OAuth redirect URI

## Response `200`

Auth settings saved. The connector is signed out and turned off.

- object
  - `success` boolean, required
  - `config` ConnectorStoredConfig, required: A connector instance's saved settings. Secret auth fields come back masked; saving the mask back keeps the stored value. Provider OAuth tokens are never returned.
    - `auth` object: Auth fields for the instance's auth type, keyed by field name
      - `authType` 'OAUTH' | 'OAUTH_ADMIN_CONSENT' | 'API_TOKEN' | 'BEARER_TOKEN' | 'BASIC_AUTH' | 'ACCESS_KEY' | 'IAM_ROLE' | 'ACCOUNT_KEY' | 'CONNECTION_STRING' | 'ENTRA_ID' | 'CUSTOM' | 'NONE': How a connector instance signs in to its source. Each connector type supports a subset; see `supportedAuthTypes` in the registry.
      - `connectorType` string: Set by the server to the instance's connector type
      - `connectorScope` 'team' | 'personal': Scope determines visibility and access control for connectors:<br> <ul> <li><code>team</code> - Available to all users in the organization (admin-only creation)</li> <li><code>personal</code> - Private to the creating user only</li> </ul>
      - `oauthConfigId` string: The shared OAuth app the instance signs in with
      - `oauthInstanceName` string
      - `redirectUri` string: OAuth redirect URI the server built for this instance
    - `sync` object: Sync strategy plus connector-specific sync settings
      - `selectedStrategy` string: `MANUAL`, `SCHEDULED` or `WEBHOOK`
      - `scheduledConfig` object: Schedule used when `selectedStrategy` is `SCHEDULED`
      - `customValues` object: Values of the connector's own sync fields
    - `filters` object: Saved filter selections
      - `sync` object: What to fetch from the source. Selections are under `values`, keyed by filter name.
      - `indexing` object: Which fetched records to index. Selections are under `values`, keyed by filter name.
  - `message` string

## Other responses

- `400`: Invalid auth settings, `auth` is not an object ("Auth configuration must be an object."), or the connector is active
- `401`: Missing or invalid credentials
- `403`: The token lacks a required scope, or the caller may not use this connector
- `404`: Not found, or the caller has no access
- `409`: The connector is locked by a sync or deletion in progress
- `500`: Internal error, for example when the body is not an object A JSON body larger than 10 MB, or a form-encoded body larger than 100 KB or with more than 1000 fields, is answered `413` by the app-wide body parsers instead, also before authentication.

## Changes

- **2026-10-28** `dbb5e203b445`: 8 info
  - added the new optional request property `auth/authType`
  - added the new optional request property `auth/connectorScope`
  - the `baseUrl` request property format was generalized from `uri` to no format
  - added the optional property `config/filters/indexing` to the response with the `200` status
  - …4 more
- **2026-10-26** `fc76aa045994`: 2 warning
  - added the new `ENTRA_ID` enum value to the `config/auth/authType` response property for the response status `200`
  - added the new `IAM_ROLE` enum value to the `config/auth/authType` response property for the response status `200`
- **2026-10-15** `a44792e4f0e6`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/changes/connectors/:connectorId/config/auth/put.md)

---

[API](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api.md) - [All operations](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/revisions/dbb5e203b445?raw)