---
title: "Save OAuth 2.0 client-credentials for an agent"
method: PUT
path: "/api/registry/agents/{encodedUrl}/oauth-client-credentials"
tags: ["Agent Compliance"]
---

# Save OAuth 2.0 client-credentials for an agent

`PUT /api/registry/agents/{encodedUrl}/oauth-client-credentials`

Store a machine-to-machine OAuth 2.0 client-credentials configuration (RFC 6749 §4.4) for this agent. The SDK exchanges at the token endpoint before every call and refreshes on 401. `client_secret` may be a `$ENV:VAR_NAME` reference — the SDK resolves at exchange time, the server stores it as written (encrypted uniformly). Requires authentication and ownership.

## Path parameters

- `encodedUrl` string, required — URL-encoded agent URL

## Request body

- object
  - `token_endpoint` string, required — Token endpoint URL (HTTPS required; localhost allowed in dev).
  - `client_id` string, required — OAuth client ID. May be a `$ENV:VAR_NAME` reference.
  - `client_secret` string, required — OAuth client secret. May be a `$ENV:VAR_NAME` reference. Stored encrypted at rest.
  - `scope` string — Space-separated OAuth scope values.
  - `resource` string — RFC 8707 resource indicator.
  - `audience` string — Audience parameter for audience-validating authorization servers.
  - `auth_method` 'basic' | 'body' — Client-credentials placement: basic (HTTP Basic header, RFC 6749 §2.3.1 preferred) or body (form fields). SDK default is basic.

## Response `200`

Credentials saved

- object
  - `connected` true, required
  - `has_auth` true, required
  - `agent_context_id` string, required
  - `auth_type` 'oauth_client_credentials', required

## Other responses

- `400` — Invalid parameters — response carries `code` and `field` pointing to the rejection cause.
- `401` — Authentication required
- `403` — Not authorized
- `500` — Server error

---

[API](https://skmtc.net/adcontextprotocol/apis/agenticadvertising-org-registry-api.md) · [All operations](https://skmtc.net/adcontextprotocol/apis/agenticadvertising-org-registry-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/adcontextprotocol/agenticadvertising-org-registry-api/versions/9ea7fedf54c0/schema)