# rpk ai oauth-client create

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [agentic-data-plane-full.txt](https://docs.redpanda.com/agentic-data-plane-full.txt)

---
title: rpk ai oauth-client create
page-beta-text: This is a beta feature. Beta features are available for testing and feedback. They are not supported by Redpanda and should not be used in production environments.
latest-operator-version: v26.1.5
latest-console-tag: v3.7.4
latest-connect-version: 4.96.1
latest-redpanda-tag: v26.1.10
docname: rpk/rpk-ai/rpk-ai-oauth-client-create
page-component-name: agentic-data-plane
page-version: master
page-component-version: master
page-component-title: Agentic Data Plane
page-relative-src-path: rpk/rpk-ai/rpk-ai-oauth-client-create.adoc
page-edit-url: https://github.com/redpanda-data/adp-docs/edit/main/modules/reference/pages/rpk/rpk-ai/rpk-ai-oauth-client-create.adoc
description: rpk ai oauth-client create
# Beta release status
page-beta: "true"
page-git-created-date: "2026-05-27"
page-git-modified-date: "2026-06-10"
release-status: beta - This is a beta feature. Beta features are available for testing and feedback. They are not supported by Redpanda and should not be used in production environments.
---

<!-- Source: https://docs.redpanda.com/agentic-data-plane/reference/rpk/rpk-ai/rpk-ai-oauth-client-create.md -->

Register an OAuth client. The generated client\_secret is printed once to stderr with a "copy this now" banner — it cannot be retrieved afterward. Store it in whatever secret manager the external tool uses.

## [](#usage)Usage

```bash
rpk ai oauth-client create [flags]
```

## [](#flags)Flags

| Value | Type | Description |
| --- | --- | --- |
| --allowed-resource | strings | MCP URL this client can request tokens for; "" = any. repeatable (default []). |
| --display-name | string | human-readable display name shown on the consent card (required). |
| --enabled | - | whether the client may request tokens (default true). |
| --grant-types | strings | grant types: authorization_code, refresh_token (default [authorization_code,refresh_token]). |
| -h, --help | - | help for create. |
| --logo-uri | string | https:// logo URI shown on the consent card. |
| --name | string | client name (required; AIP-122 resource identifier). |
| --pkce-required | - | require PKCE (RFC 7636) on authorization requests (default true). |
| --redirect-uri | strings | allowed redirect URI (exact match; repeatable, required). |
| --token-endpoint-auth-method | string | token endpoint auth: client_secret_basic, client_secret_post, none (default "client_secret_basic"). |
| -o, --format | string | output format: table |
| wide | json | yaml |
| markdown (env: RPAI_FORMAT) (default "table"). | --no-color | - |
| disable colored output (env: NO_COLOR). | -c, --rpai-config | string |
| path to rpai config (env: RPAI_CONFIG) (default "/var/lib/redpanda/.rpai/config"). | -s, --rpai-endpoint | string |
| override dataplane URL (env: RPAI_ENDPOINT). | -p, --rpai-profile | string |
| rpai profile name (env: RPAI_PROFILE). | -v, --rpai-verbose | - |
| verbose debug logging to stderr (env: RPAI_VERBOSE). | --token | string |