--- title: OAuth Clients --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) [IAM](https://developers.cloudflare.com/api/typescript/resources/iam) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # OAuth Clients ##### [List OAuth Clients](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/list) client.iam.oauthClients.list(OAuthClientListParams {account\_id } params, RequestOptionsoptions?): SinglePage< [OAuthClientListResponse]() {client\_id, visibility, allowed\_cors\_origins, 17 more } > GET/accounts/{account\_id}/oauth\_clients ##### [OAuth Client Details](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/get) client.iam.oauthClients.get(stringoauthClientID, OAuthClientGetParams {account\_id } params, RequestOptionsoptions?): [OAuthClientGetResponse]() {client\_id, visibility, allowed\_cors\_origins, 17 more } GET/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Create OAuth Client](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/create) client.iam.oauthClients.create(OAuthClientCreateParams {account\_id, client\_name, grant\_types, 11 more } params, RequestOptionsoptions?): [OAuthClientCreateResponse]() {client\_id, visibility, allowed\_cors\_origins, 18 more } POST/accounts/{account\_id}/oauth\_clients ##### [Update OAuth Client](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/update) client.iam.oauthClients.update(stringoauthClientID, OAuthClientUpdateParams {account\_id, allowed\_cors\_origins, client\_name, 12 more } params, RequestOptionsoptions?): [OAuthClientUpdateResponse]() {client\_id, visibility, allowed\_cors\_origins, 17 more } PATCH/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Delete OAuth Client](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/delete) client.iam.oauthClients.delete(stringoauthClientID, OAuthClientDeleteParams {account\_id } params, RequestOptionsoptions?): [OAuthClientDeleteResponse]() {id } | null DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Rotate OAuth Client Secret](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/rotate_secret) client.iam.oauthClients.rotateSecret(stringoauthClientID, OAuthClientRotateSecretParams {account\_id } params, RequestOptionsoptions?): [OAuthClientRotateSecretResponse]() {client\_secret } POST/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### [Delete Rotated OAuth Client Secret](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/delete_rotated_secret) client.iam.oauthClients.deleteRotatedSecret(stringoauthClientID, OAuthClientDeleteRotatedSecretParams {account\_id } params, RequestOptionsoptions?): [OAuthClientDeleteRotatedSecretResponse]() {id } | null DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### ModelsExpand Collapse
OAuthClientListResponse {client\_id, visibility, allowed\_cors\_origins, 17 more } Fields shared by OAuth client responses and create/update requests. client\_id: string The unique identifier for an OAuth client. Link to this property
visibility: "public"| "private" Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins?: Array<string> Array of allowed CORS origins. Link to this property client\_name?: string Human-readable name of the OAuth client. Link to this property client\_uri?: string URL of the home page of the client. Link to this property
client\_uri\_verification?: ClientURIVerification {status, text } Client URI domain control verification state.
status?: "pending"| "in\_progress"| "verified"| "failed" Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text?: string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at?: string Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types?: Array<"authorization\_code"| "refresh\_token"> Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret?: boolean Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri?: string URL of the client’s logo. Link to this property optional\_scopes?: Array<string> Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri?: string URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris?: Array<string> Array of allowed post-logout redirect URIs. Link to this property promoted\_at?: string Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris?: Array<string> Array of allowed redirect URIs for the client. Link to this property
response\_types?: Array<"token"| "id\_token"| "code"> Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes?: Array<string> Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method?: "none"| "client\_secret\_basic"| "client\_secret\_post" The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri?: string URL that points to a terms of service document. Link to this property updated\_at?: string Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_list_response%20%3E%20(schema)>)
OAuthClientGetResponse {client\_id, visibility, allowed\_cors\_origins, 17 more } Fields shared by OAuth client responses and create/update requests. client\_id: string The unique identifier for an OAuth client. Link to this property
visibility: "public"| "private" Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins?: Array<string> Array of allowed CORS origins. Link to this property client\_name?: string Human-readable name of the OAuth client. Link to this property client\_uri?: string URL of the home page of the client. Link to this property
client\_uri\_verification?: ClientURIVerification {status, text } Client URI domain control verification state.
status?: "pending"| "in\_progress"| "verified"| "failed" Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text?: string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at?: string Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types?: Array<"authorization\_code"| "refresh\_token"> Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret?: boolean Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri?: string URL of the client’s logo. Link to this property optional\_scopes?: Array<string> Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri?: string URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris?: Array<string> Array of allowed post-logout redirect URIs. Link to this property promoted\_at?: string Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris?: Array<string> Array of allowed redirect URIs for the client. Link to this property
response\_types?: Array<"token"| "id\_token"| "code"> Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes?: Array<string> Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method?: "none"| "client\_secret\_basic"| "client\_secret\_post" The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri?: string URL that points to a terms of service document. Link to this property updated\_at?: string Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_get_response%20%3E%20(schema)>)
OAuthClientCreateResponse {client\_id, visibility, allowed\_cors\_origins, 18 more } Fields shared by OAuth client responses and create/update requests. client\_id: string The unique identifier for an OAuth client. Link to this property
visibility: "public"| "private" Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins?: Array<string> Array of allowed CORS origins. Link to this property client\_name?: string Human-readable name of the OAuth client. Link to this property client\_secret?: string The client secret. This is the only time the secret is returned in a response. Link to this property client\_uri?: string URL of the home page of the client. Link to this property
client\_uri\_verification?: ClientURIVerification {status, text } Client URI domain control verification state.
status?: "pending"| "in\_progress"| "verified"| "failed" Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text?: string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at?: string Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types?: Array<"authorization\_code"| "refresh\_token"> Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret?: boolean Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri?: string URL of the client’s logo. Link to this property optional\_scopes?: Array<string> Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri?: string URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris?: Array<string> Array of allowed post-logout redirect URIs. Link to this property promoted\_at?: string Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris?: Array<string> Array of allowed redirect URIs for the client. Link to this property
response\_types?: Array<"token"| "id\_token"| "code"> Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes?: Array<string> Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method?: "none"| "client\_secret\_basic"| "client\_secret\_post" The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri?: string URL that points to a terms of service document. Link to this property updated\_at?: string Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_create_response%20%3E%20(schema)>)
OAuthClientUpdateResponse {client\_id, visibility, allowed\_cors\_origins, 17 more } Fields shared by OAuth client responses and create/update requests. client\_id: string The unique identifier for an OAuth client. Link to this property
visibility: "public"| "private" Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins?: Array<string> Array of allowed CORS origins. Link to this property client\_name?: string Human-readable name of the OAuth client. Link to this property client\_uri?: string URL of the home page of the client. Link to this property
client\_uri\_verification?: ClientURIVerification {status, text } Client URI domain control verification state.
status?: "pending"| "in\_progress"| "verified"| "failed" Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text?: string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at?: string Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types?: Array<"authorization\_code"| "refresh\_token"> Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret?: boolean Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri?: string URL of the client’s logo. Link to this property optional\_scopes?: Array<string> Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri?: string URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris?: Array<string> Array of allowed post-logout redirect URIs. Link to this property promoted\_at?: string Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris?: Array<string> Array of allowed redirect URIs for the client. Link to this property
response\_types?: Array<"token"| "id\_token"| "code"> Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes?: Array<string> Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method?: "none"| "client\_secret\_basic"| "client\_secret\_post" The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri?: string URL that points to a terms of service document. Link to this property updated\_at?: string Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_update_response%20%3E%20(schema)>)
OAuthClientDeleteResponse {id } id: string Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_delete_response%20%3E%20(schema)>)
OAuthClientRotateSecretResponse {client\_secret } client\_secret?: string The new client secret. Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_rotate_secret_response%20%3E%20(schema)>)
OAuthClientDeleteRotatedSecretResponse {id } id: string Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_delete_rotated_secret_response%20%3E%20(schema)>)