rpk ai oauth-client create
Register an OAuth client with the AI gateway. The generated client secret is printed once and cannot be retrieved afterward. Save it immediately in a secret manager.
Flags
| Value | Type | Description |
|---|---|---|
|
string |
Shown on the user consent page. Use the external tool’s brand name. |
|
string |
Logo URL displayed alongside the client name on the consent page. HTTPS only. |
|
strings |
Allowed redirect URIs (exact match, RFC 3986 normalized). No query or fragment components. (repeatable; replaces the full list on update). |
|
strings |
MCP URLs this client may request tokens for. Use "*" to allow any MCP on this gateway. (repeatable; replaces the full list on update). |
|
strings |
OAuth grant types this client may use. Authorization Code + Refresh Token is the standard combination. (one of: oauth-client-grant-type-authorization-code, oauth-client-grant-type-refresh-token; repeatable; replaces the full list on update). |
|
string |
How the client authenticates to the token endpoint. Phase 1 supports client_secret_basic and client_secret_post. (one of: oauth-client-token-endpoint-auth-method-client-secret-basic, oauth-client-token-endpoint-auth-method-client-secret-post, oauth-client-token-endpoint-auth-method-none). |
|
bool |
Require PKCE (RFC 7636) on authorization requests. Strongly recommended and enforced by default. (true when set; pass |
|
bool |
Whether this client may request new tokens. Disabled clients are rejected at the authorize endpoint. (true when set; pass |
|
stringArray |
Tags. (repeatable key=value; replaces the full map on update). (New in 0.2.33) |
|
string |
manifest to create from (YAML or JSON; "-" for stdin); flags override file values. |
|
bool |
print the request that would be sent (with the computed update mask) and exit without calling the server. |
Global flags
| Value | Type | Description |
|---|---|---|
|
string |
Redpanda or |
|
stringArray |
Override |
|
bool |
Ignore |
|
string |
|
|
bool |
Enable verbose logging. |