---
title: "Update app sign-in settings"
method: PATCH
path: "/v1/spaces/{spaceId}/users/settings"
tags: ["Spaces"]
---

# Update app sign-in settings

`PATCH /v1/spaces/{spaceId}/users/settings`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/spaces/{spaceId}/users/settings`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://api.spacefast.com/v1/auth/oauth2/authorize`, token URL `https://api.spacefast.com/v1/auth/oauth2/token`; client credentials, token URL `https://api.spacefast.com/v1/auth/oauth2/token`, scopes: `spaces:write`)

Turns visitor sign-in for this Space's app on or off and chooses its sign-in methods. Send the complete `settings` with `baseSettingsDigest` from the latest read; a stale digest refuses the write. For Google mode `direct`, `directGoogleSecret` saves the client secret write-only and `null` removes it; it is never returned. Only change sign-in at the user's request. App accounts sign in to the published Space only; they never grant team or Space access. Requires permission to manage the Space.

## Path parameters

- `spaceId` string, required

## Request body

- object
  - `settings` object, required
    - `enabled` boolean, required
    - `providers` object, required
      - `google` union, required
        - object
          - `mode` 'disabled', required
        - object
          - `mode` 'managed', required
        - object
          - `mode` 'direct', required
          - `clientId` string, required
      - `gravatar` object, required
        - `enabled` boolean, required
      - `spacefast` object, required
        - `enabled` boolean, required
  - `baseSettingsDigest` string, required
  - `directGoogleSecret` string, nullable: Write-only direct Google client secret. Null removes it. Never returned.

## Response `200`

Response for status 200

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object, required
    - `settings` object, required
      - `enabled` boolean, required
      - `providers` object, required
        - `google` union, required
          - object
            - `mode` 'disabled', required
          - object
            - `mode` 'managed', required
          - object
            - `mode` 'direct', required
            - `clientId` string, required
        - `gravatar` object, required
          - `enabled` boolean, required
        - `spacefast` object, required
          - `enabled` boolean, required
    - `availability` object, required
      - `google` object, required
        - `managed` boolean, required
        - `direct` boolean, required
      - `gravatar` boolean, required
      - `spacefast` true, required
    - `settingsDigest` string, required
    - `googleCallbackUrl` string, uri, required

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)