---
title: "POST /create-auth-method-oauth2"
method: POST
path: "/create-auth-method-oauth2"
tags: ["v2"]
---

# POST /create-auth-method-oauth2

`POST /create-auth-method-oauth2`

## Request body

- CreateAuthMethodOAuth2 — createAuthMethodOAuth2 is a command that creates a new auth method that will be able to authenticate using Oauth2. [Deprecated: Use auth-method-create-oauth2 command]
  - `access-expires` integer — Access expiration date in Unix timestamp (select 0 for access without expiry date)
  - `allowed-client-type` string[] — limit the auth method usage for specific client types [cli,ui,gateway-admin,sdk,mobile,extension]
  - `audience` string — The audience in the JWT
  - `audit-logs-claims` string[] — Subclaims to include in audit logs, e.g "--audit-logs-claims email --audit-logs-claims username"
  - `bound-client-ids` string[] — The clients ids that the access is restricted to
  - `bound-ips` string[] — A CIDR whitelist with the IPs that the access is restricted to
  - `cert` string — CertificateFile Path to a file that contain the certificate in a PEM format.
  - `cert-file-data` string — CertificateFileData PEM Certificate in a Base64 format.
  - `delete_protection` string — Protection from accidental deletion of this object [true/false]
  - `description` string — Auth Method description
  - `expiration-event-in` string[] — How many days before the expiration of the auth method would you like to be notified.
  - `force-sub-claims` boolean — if true: enforce role-association must include sub claims
  - `gateway-url` string — Akeyless Gateway URL (Configuration Management port). Relevant only when the jwks-uri is accessible only from the gateway.
  - `gw-bound-ips` string[] — A CIDR whitelist with the GW IPs that the access is restricted to
  - `issuer` string — Issuer URL
  - `json` boolean — Set output format to JSON
  - `jwks-json-data` string — The JSON Web Key Set (JWKS) that containing the public keys that should be used to verify any JSON Web Token (JWT) issued by the authorization server. base64 encoded string
  - `jwks-uri` string — The URL to the JSON Web Key Set (JWKS) that containing the public keys that should be used to verify any JSON Web Token (JWT) issued by the authorization server.
  - `jwt-ttl` integer — Jwt TTL
  - `name` string, required — Auth Method name
  - `product-type` string[] — Choose the relevant product type for the auth method [sm, sra, pm, dp, ca]
  - `subclaims-delimiters` string[] — A list of additional sub claims delimiters (relevant only for SAML, OIDC, OAuth2/JWT)
  - `token` string — Authentication token (see `/auth` and `/configure`)
  - `uid-token` string — The universal identity token, Required only for universal_identity authentication
  - `unique-identifier` string, required — A unique identifier (ID) value should be configured for OAuth2, LDAP and SAML authentication method types and is usually a value such as the email, username, or upn for example. Whenever a user logs in with a token, these authentication types issue a "sub claim" that contains details uniquely identifying that user. This sub claim includes a key containing the ID value that you configured, and is used to distinguish between different users from within the same organization.

## Response `200`

createAuthMethodOAuth2Response wraps response body.

- CreateAuthMethodOAuth2Output
  - `access_id` string

## Other responses

- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)