API Reference

Getting Started

Core Concepts

Backend API — Guides

Frontend API — Guides

OAuth & OpenID Connect — Guides

Enterprise: SSO & SCIM — Guides

Webhooks — Guides

SDKs

Frontend API (FAPI)

Public API

SCIM

OIDC

Oauth2

Platform

Apps

Oauth Clients

Written for: ＋ Written for
Deprecated: ＋ Deprecated
Applies to: ＋ Applies to

AdminUpdated Sep 11, 2026

Oauth Clients

Backend API — secret key (Authorization: Bearer sk_…).

9 routes. Each row is one endpoint with its explanation, required scope, and whether it honours the Idempotency-Key header.

Method & path	Scope	Idem	Explanation
`GET /v1/oauth_clients/:clientId/grants`	`oauth_clients:read`		List the resource-server grants (client_credentials authorizations) of a client.
`POST /v1/oauth_clients/:clientId/grants`	`oauth_clients:write`		Authorize a confidential client for a resource server and its scopes.
`DELETE /v1/oauth_clients/:clientId/grants/:grantId`	`oauth_clients:write`		Revoke a client's grant for a resource server.
`GET /v1/oauth_clients`	`oauth_clients:read`		List "Sign in with Atlas" OAuth clients. The client secret is never returned.
`POST /v1/oauth_clients`	`oauth_clients:write`	✓	Register an OAuth client (confidential or public PKCE). A confidential client's secret is revealed exactly once.
`GET /v1/oauth_clients/:id`	`oauth_clients:read`		Fetch one OAuth client. Another instance id is 404, never 403. Never the secret.
`PATCH /v1/oauth_clients/:id`	`oauth_clients:write`	✓	Update an OAuth client's registration (name, redirect_uris, scopes). The secret is immutable here.
`POST /v1/oauth_clients/:id/rotate_secret`	`oauth_clients:write`	✓	Rotate a confidential client's secret; the new one is revealed exactly once.
`DELETE /v1/oauth_clients/:id`	`oauth_clients:write`	✓	Delete an OAuth client; its codes and grants cascade with it.

Was this page helpful?

Oauth Clients