Agentic Data Plane
Preview

rpk ai oauth-client update

Update an OAuth client.

This command was introduced in ai version 0.2.28.

Usage

rpk ai oauth-client update [flags]

Flags

Value Type Description

--display-name

string

Shown on the user consent page. Use the external tool’s brand name.

--logo-uri

string

Logo URL displayed alongside the client name on the consent page. HTTPS only.

--redirect-uris

strings

Allowed redirect URIs (exact match, RFC 3986 normalized). No query or fragment components. (repeatable; replaces the full list on update).

--allowed-resources

strings

MCP URLs this client may request tokens for. Use "*" to allow any MCP on this gateway. (repeatable; replaces the full list on update).

--grant-types

strings

OAuth grant types this client may use. Authorization Code + Refresh Token is the standard combination. (one of: oauth-client-grant-type-authorization-code, oauth-client-grant-type-refresh-token; repeatable; replaces the full list on update).

--token-endpoint-auth-method

string

How the client authenticates to the token endpoint. Phase 1 supports client_secret_basic and client_secret_post. (one of: oauth-client-token-endpoint-auth-method-client-secret-basic, oauth-client-token-endpoint-auth-method-client-secret-post, oauth-client-token-endpoint-auth-method-none).

--pkce-required

bool

Require PKCE (RFC 7636) on authorization requests. Strongly recommended and enforced by default. (true when set; pass --pkce-required=false to disable).

--enabled

bool

Whether this client may request new tokens. Disabled clients are rejected at the authorize endpoint. (true when set; pass --enabled=false to disable).

--tags

stringArray

Tags. (repeatable key=value; replaces the full map on update). (New in 0.2.33)

-f, --filename

string

manifest to update from (YAML or JSON; "-" for stdin); flags override file values.

--dry-run

bool

print the request that would be sent (with the computed update mask) and exit without calling the server.

--clear

strings

field paths to clear (added to the update mask with the field unset), for example, --clear guardrail.

--update-mask

strings

override the inferred update mask with exactly these paths.

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.