--- title: OAuth Clients --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [IAM](https://developers.cloudflare.com/api/python/resources/iam) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # OAuth Clients ##### [List OAuth Clients](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/list) iam.oauth\_clients.list(OAuthClientListParams\*\*kwargs) -> SyncSinglePage\[[OAuthClientListResponse]()] GET/accounts/{account\_id}/oauth\_clients ##### [OAuth Client Details](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/get) iam.oauth\_clients.get(stroauth\_client\_id, OAuthClientGetParams\*\*kwargs) -> [OAuthClientGetResponse]() GET/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Create OAuth Client](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/create) iam.oauth\_clients.create(OAuthClientCreateParams\*\*kwargs) -> [OAuthClientCreateResponse]() POST/accounts/{account\_id}/oauth\_clients ##### [Update OAuth Client](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/update) iam.oauth\_clients.update(stroauth\_client\_id, OAuthClientUpdateParams\*\*kwargs) -> [OAuthClientUpdateResponse]() PATCH/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Delete OAuth Client](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/delete) iam.oauth\_clients.delete(stroauth\_client\_id, OAuthClientDeleteParams\*\*kwargs) -> [OAuthClientDeleteResponse]() DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Rotate OAuth Client Secret](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/rotate_secret) iam.oauth\_clients.rotate\_secret(stroauth\_client\_id, OAuthClientRotateSecretParams\*\*kwargs) -> [OAuthClientRotateSecretResponse]() POST/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### [Delete Rotated OAuth Client Secret](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/delete_rotated_secret) iam.oauth\_clients.delete\_rotated\_secret(stroauth\_client\_id, OAuthClientDeleteRotatedSecretParams\*\*kwargs) -> [OAuthClientDeleteRotatedSecretResponse]() DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### ModelsExpand Collapse
class OAuthClientListResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. Link to this property
visibility: Literal\["public", "private"] Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins: Optional\[List\[str]] Array of allowed CORS origins. Link to this property client\_name: Optional\[str] Human-readable name of the OAuth client. Link to this property client\_uri: Optional\[str] URL of the home page of the client. Link to this property
client\_uri\_verification: Optional\[ClientURIVerification] Client URI domain control verification state.
status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"]] Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text: Optional\[str] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at: Optional\[datetime] Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"]]] Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret: Optional\[bool] Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri: Optional\[str] URL of the client’s logo. Link to this property optional\_scopes: Optional\[List\[str]] Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri: Optional\[str] URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris: Optional\[List\[str]] Array of allowed post-logout redirect URIs. Link to this property promoted\_at: Optional\[datetime] Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris: Optional\[List\[str]] Array of allowed redirect URIs for the client. Link to this property
response\_types: Optional\[List\[Literal\["token", "id\_token", "code"]]] Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes: Optional\[List\[str]] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"]] The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri: Optional\[str] URL that points to a terms of service document. Link to this property updated\_at: Optional\[datetime] Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_list_response%20%3E%20(schema)>)
class OAuthClientGetResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. Link to this property
visibility: Literal\["public", "private"] Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins: Optional\[List\[str]] Array of allowed CORS origins. Link to this property client\_name: Optional\[str] Human-readable name of the OAuth client. Link to this property client\_uri: Optional\[str] URL of the home page of the client. Link to this property
client\_uri\_verification: Optional\[ClientURIVerification] Client URI domain control verification state.
status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"]] Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text: Optional\[str] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at: Optional\[datetime] Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"]]] Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret: Optional\[bool] Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri: Optional\[str] URL of the client’s logo. Link to this property optional\_scopes: Optional\[List\[str]] Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri: Optional\[str] URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris: Optional\[List\[str]] Array of allowed post-logout redirect URIs. Link to this property promoted\_at: Optional\[datetime] Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris: Optional\[List\[str]] Array of allowed redirect URIs for the client. Link to this property
response\_types: Optional\[List\[Literal\["token", "id\_token", "code"]]] Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes: Optional\[List\[str]] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"]] The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri: Optional\[str] URL that points to a terms of service document. Link to this property updated\_at: Optional\[datetime] Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_get_response%20%3E%20(schema)>)
class OAuthClientCreateResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. Link to this property
visibility: Literal\["public", "private"] Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins: Optional\[List\[str]] Array of allowed CORS origins. Link to this property client\_name: Optional\[str] Human-readable name of the OAuth client. Link to this property client\_secret: Optional\[str] The client secret. This is the only time the secret is returned in a response. Link to this property client\_uri: Optional\[str] URL of the home page of the client. Link to this property
client\_uri\_verification: Optional\[ClientURIVerification] Client URI domain control verification state.
status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"]] Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text: Optional\[str] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at: Optional\[datetime] Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"]]] Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret: Optional\[bool] Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri: Optional\[str] URL of the client’s logo. Link to this property optional\_scopes: Optional\[List\[str]] Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri: Optional\[str] URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris: Optional\[List\[str]] Array of allowed post-logout redirect URIs. Link to this property promoted\_at: Optional\[datetime] Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris: Optional\[List\[str]] Array of allowed redirect URIs for the client. Link to this property
response\_types: Optional\[List\[Literal\["token", "id\_token", "code"]]] Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes: Optional\[List\[str]] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"]] The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri: Optional\[str] URL that points to a terms of service document. Link to this property updated\_at: Optional\[datetime] Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_create_response%20%3E%20(schema)>)
class OAuthClientUpdateResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. Link to this property
visibility: Literal\["public", "private"] Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins: Optional\[List\[str]] Array of allowed CORS origins. Link to this property client\_name: Optional\[str] Human-readable name of the OAuth client. Link to this property client\_uri: Optional\[str] URL of the home page of the client. Link to this property
client\_uri\_verification: Optional\[ClientURIVerification] Client URI domain control verification state.
status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"]] Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text: Optional\[str] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at: Optional\[datetime] Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"]]] Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret: Optional\[bool] Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri: Optional\[str] URL of the client’s logo. Link to this property optional\_scopes: Optional\[List\[str]] Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri: Optional\[str] URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris: Optional\[List\[str]] Array of allowed post-logout redirect URIs. Link to this property promoted\_at: Optional\[datetime] Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris: Optional\[List\[str]] Array of allowed redirect URIs for the client. Link to this property
response\_types: Optional\[List\[Literal\["token", "id\_token", "code"]]] Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes: Optional\[List\[str]] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"]] The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri: Optional\[str] URL that points to a terms of service document. Link to this property updated\_at: Optional\[datetime] Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_update_response%20%3E%20(schema)>)
class OAuthClientDeleteResponse: … id: str Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_delete_response%20%3E%20(schema)>)
class OAuthClientRotateSecretResponse: … client\_secret: Optional\[str] The new client secret. Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_rotate_secret_response%20%3E%20(schema)>)
class OAuthClientDeleteRotatedSecretResponse: … id: str Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_delete_rotated_secret_response%20%3E%20(schema)>)