rpk ai oauth-provider create

string

Shown to users when selecting this provider. Use the provider’s brand name.

string

The URL where users are redirected to grant consent. Found in your provider’s OAuth documentation.

string

The URL where the gateway exchanges authorization codes for access tokens.

string

Optional. Called when a user disconnects. Not all providers support token revocation.

string

OAuth client ID from the provider’s developer console. Omit when using register_from_url (it is discovered and registered automatically).

string

Reference to a secret stored in the secret store. Not required for public clients using PKCE.

strings

OAuth scopes determine what data and actions the token grants access to. Set to the union of all scopes needed across MCP servers to avoid re-consent. (repeatable; replaces the full list on update).

strings

Select at least one grant type. Browser Consent is the standard OAuth 2.0 flow. Token Exchange enables server-to-server delegation. (one of: oauth-grant-type-browser-consent, oauth-grant-type-token-exchange; repeatable; replaces the full list on update).

bool

Proof Key for Code Exchange adds a challenge to the authorization flow, preventing code interception attacks. Recommended for all providers. (true when set; pass --pkce-required=false to disable).

string

How the gateway authenticates when exchanging codes for tokens. Check your provider’s documentation for the supported method. (one of: oauth-token-endpoint-auth-method-client-secret-basic, oauth-token-endpoint-auth-method-client-secret-post, oauth-token-endpoint-auth-method-none).

stringArray

Additional query parameters appended to the authorization URL. (repeatable key=value; replaces the full map on update).

stringArray

Additional parameters sent in the token exchange request body. (repeatable key=value; replaces the full map on update).

bool

Whether this provider accepts new connections. (true when set; pass --enabled=false to disable).

string

Remote MCP server URL to auto-detect OAuth from. The gateway discovers endpoints and registers a client automatically.

stringArray

Tags. (repeatable key=value; replaces the full map on update). (New in 0.2.33)

string

manifest to create from (YAML or JSON; "-" for stdin); flags override file values.

bool

print the request that would be sent (with the computed update mask) and exit without calling the server.

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

string

rpk profile to use.

bool

Enable verbose logging.