---
title: "Set Endpoint Oauth Config"
method: PUT
path: "/api/v1/app/{app_id}/endpoint/{endpoint_id}/oauth"
tags: ["Endpoint"]
---

# Set Endpoint Oauth Config

`PUT /api/v1/app/{app_id}/endpoint/{endpoint_id}/oauth`

## Request

- Base URL: `https://api.eu.svix.com`
- URL: `https://api.eu.svix.com/api/v1/app/{app_id}/endpoint/{endpoint_id}/oauth`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/svix/apis/svix-api/docs/api/v1/app/:app_id/endpoint/:endpoint_id/oauth/put.ts> (a function with typed inputs; its response is checked against the schema)

Set endpoint OAuth configuration.

This operation is only available in the <a href="https://svix.com/pricing" target="_blank">Enterprise</a> plan.

## Path parameters

- `app_id` string, required: The Application's ID or UID.
- `endpoint_id` string, required: The Endpoint's ID or UID.

## Request body

- EndpointOauthConfigIn
  - `authMethod` 'clientSecretJwt' | 'clientSecretBasic' | 'clientSecretPost', required: The method used for authenticating to the OAuth authorization server. `clientSecretJwt` will construct a JWT used for authentication with the oauth authorization server. This method is less commonly used and may not be supported by all oauth providers. `clientSecretBasic` will authenticate to the oauth authorization server using an `Authorization` header with the client secret as the value. This is the most common means of authentication. `clientSecretPost` will authenticate to the oauth authorization server by passing the client secret in a `client_secret` field in the request body. This method may not be supported by all oauth providers, and in general `clientSecretBasic` should be preferred.
  - `clientId` string, required: The client ID. Required for all authentication types.
  - `clientSecret` string, nullable: Optional client secret. This is only used for `clientSecretBasic` and `clientSecretPost`. For `clientSecretBasic`, the secret will be appended to the `Authorization` header. For `clientSecretPost`, this will be added to the body in a `client_secret` parameter.
  - `extraHeaders` object, nullable: Optional headers added to the token request.
  - `extraParams` object, nullable: Extra parameters added to the request body as key-value pairs.
  - `grantType` 'clientCredentials' | 'refreshToken', required
  - `jwtParams` ClientSecretJwtParamsIn
    - `secretBase64` string, required: The base64-encoded secret used for signing the JWT.
    - `secretId` string, nullable: Optional secret identifier. If supplied, this will be populated in the JWT header in the `kid` field.
    - `signingAlgorithm` 'RS256', required
    - `tokenExpirySecs` integer, nullable: Optional number of seconds after which the JWT should expire. Defaults to 300 seconds.
  - `refreshToken` string, nullable: For `refreshToken` grant type.
  - `scopes` string[], nullable: Optional OAuth scopes added to the request body.
  - `tokenUrl` string, uri, required: The URL of the authorization server.

## Response `204`

no content

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict
- `422`: Validation Error
- `429`: Too Many Requests

## Changes

- **2026-11-09** `f2cb264ac18a`: 1 info
  - endpoint added
- **2026-08-19** `dc130bd1b074`: 1 breaking
  - api path removed without deprecation
- **2026-07-31** `16dbcc056c48`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/svix/apis/svix-api/changes/api/v1/app/:app_id/endpoint/:endpoint_id/oauth/put.md)

---

[API](https://skmtc.dev/svix/apis/svix-api.md) - [All operations](https://skmtc.dev/svix/apis/svix-api/llms.txt) - [OpenAPI document](https://skmtc.dev/svix/apis/svix-api/revisions/f2cb264ac18a?raw)