# rpk ai oauth-provider update

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [agentic-data-plane-full.txt](https://docs.redpanda.com/agentic-data-plane-full.txt)

---
title: rpk ai oauth-provider update
latest-operator-version: v26.2.1
latest-console-tag: v3.10.0
latest-connect-version: 4.105.0
latest-redpanda-tag: v26.2.1
docname: rpk/rpk-ai/rpk-ai-oauth-provider-update
page-component-name: agentic-data-plane
page-version: master
page-component-version: master
page-component-title: Agentic Data Plane
page-relative-src-path: rpk/rpk-ai/rpk-ai-oauth-provider-update.adoc
page-edit-url: https://github.com/redpanda-data/adp-docs/edit/main/modules/reference/pages/rpk/rpk-ai/rpk-ai-oauth-provider-update.adoc
description: Update an OAuth provider.
page-git-created-date: "2026-07-02"
page-git-modified-date: "2026-08-06"
---

<!-- Source: https://docs.redpanda.com/agentic-data-plane/reference/rpk/rpk-ai/rpk-ai-oauth-provider-update.md -->

Update an OAuth provider.

## [](#usage)Usage

```bash
rpk ai oauth-provider update [flags]
```

## [](#flags)Flags

| Value | Type | Description |
| --- | --- | --- |
| --display-name | string | Shown to users when selecting this provider. Use the provider’s brand name. |
| --authorization-endpoint | string | The URL where users are redirected to grant consent. Found in your provider’s OAuth documentation. |
| --token-endpoint | string | The URL where the gateway exchanges authorization codes for access tokens. |
| --revocation-endpoint | string | Optional. Called when a user disconnects. Not all providers support token revocation. |
| --client-secret-ref | string | Reference to a secret stored in the secret store. Not required for public clients using PKCE. |
| --scopes | strings | OAuth scopes determine what data and actions the token grants access to. Set to the union of all scopes needed across MCP servers to avoid re-consent. (repeatable; replaces the full list on update). |
| --grant-types | strings | Select at least one grant type. Browser Consent is the standard OAuth 2.0 flow. Token Exchange enables server-to-server delegation. (one of: oauth-grant-type-browser-consent, oauth-grant-type-token-exchange; repeatable; replaces the full list on update). |
| --pkce-required | bool | Proof Key for Code Exchange adds a challenge to the authorization flow, preventing code interception attacks. Recommended for all providers. (true when set; pass --pkce-required=false to disable). |
| --token-endpoint-auth-method | string | How the gateway authenticates when exchanging codes for tokens. Check your provider’s documentation for the supported method. (one of: oauth-token-endpoint-auth-method-client-secret-basic, oauth-token-endpoint-auth-method-client-secret-post, oauth-token-endpoint-auth-method-none). |
| --extra-auth-params | stringArray | Additional query parameters appended to the authorization URL. (repeatable key=value; replaces the full map on update). |
| --extra-token-params | stringArray | Additional parameters sent in the token exchange request body. (repeatable key=value; replaces the full map on update). |
| --enabled | bool | Whether this provider accepts new connections. (true when set; pass --enabled=false to disable). |
| --tags | stringArray | Tags. (repeatable key=value; replaces the full map on update). (New in 0.2.33) |
| -f, --filename | string | manifest to update from (YAML or JSON; "-" for stdin); flags override file values. |
| --dry-run | bool | print the request that would be sent (with the computed update mask) and exit without calling the server. |
| --clear | strings | field paths to clear (added to the update mask with the field unset), for example, --clear guardrail. |
| --update-mask | strings | override the inferred update mask with exactly these paths. |

## [](#global-flags)Global flags

| Value | Type | Description |
| --- | --- | --- |
| --config | string | Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml. |
| -X, --config-opt | stringArray | Override rpk configuration settings; -X help for detail or -X list for terser detail. |
| --ignore-profile | bool | Ignore rpk.yaml and redpanda.yaml; use default settings. |
| --profile | string | rpk profile to use. |
| -v, --verbose | bool | Enable verbose logging. |