Agentic Data Plane
Preview

rpk ai oauth-client create

Register an OAuth client with the AI gateway. The generated client secret is printed once and cannot be retrieved afterward. Save it immediately in a secret manager.

Usage

rpk ai oauth-client create [flags]

Flags

Value Type Description

--display-name

string

Shown on the user consent page. Use the external tool’s brand name.

--logo-uri

string

Logo URL displayed alongside the client name on the consent page. HTTPS only.

--redirect-uris

strings

Allowed redirect URIs (exact match, RFC 3986 normalized). No query or fragment components. (repeatable; replaces the full list on update).

--allowed-resources

strings

MCP URLs this client may request tokens for. Use "*" to allow any MCP on this gateway. (repeatable; replaces the full list on update).

--grant-types

strings

OAuth grant types this client may use. Authorization Code + Refresh Token is the standard combination. (one of: oauth-client-grant-type-authorization-code, oauth-client-grant-type-refresh-token; repeatable; replaces the full list on update).

--token-endpoint-auth-method

string

How the client authenticates to the token endpoint. Phase 1 supports client_secret_basic and client_secret_post. (one of: oauth-client-token-endpoint-auth-method-client-secret-basic, oauth-client-token-endpoint-auth-method-client-secret-post, oauth-client-token-endpoint-auth-method-none).

--pkce-required

bool

Require PKCE (RFC 7636) on authorization requests. Strongly recommended and enforced by default. (true when set; pass --pkce-required=false to disable).

--enabled

bool

Whether this client may request new tokens. Disabled clients are rejected at the authorize endpoint. (true when set; pass --enabled=false to disable).

--tags

stringArray

Tags. (repeatable key=value; replaces the full map on update). (New in 0.2.33)

-f, --filename

string

manifest to create from (YAML or JSON; "-" for stdin); flags override file values.

--dry-run

bool

print the request that would be sent (with the computed update mask) and exit without calling the server.

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.