---
title: "Update App Auth Strategy"
method: PATCH
path: "/v2/application-auth-strategies/{authStrategyId}"
tags: ["App Auth Strategies"]
---

# Update App Auth Strategy

`PATCH /v2/application-auth-strategies/{authStrategyId}`

Updates an application auth strategy.

## Request body

- UpdateAppAuthStrategyRequest — Request body for updating an Application Auth Strategy
  - `name` string — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI.
  - `display_name` string — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI.
  - `labels` LabelsUpdate, nullable — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Labels are intended to store **INTERNAL** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `dcr_provider_id` string, uuid, nullable
  - `configs` union — JSON-B object containing the configuration for the OIDC strategy under the key 'openid-connect' or the configuration for the Key Auth strategy under the key 'key-auth'
    - object
      - `openid-connect` PartialAppAuthStrategyConfigOpenIDConnect, required — A more advanced mode to configure an API Product Version’s Application Auth Strategy. Using this mode will allow developers to use API credentials issued from an external IdP that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for the same Auth Strategy. An OIDC strategy may be used in conjunction with a DCR provider to automatically create the IdP application.
        - `issuer` string, url
        - `credential_claim` string[]
        - `scopes` string[]
        - `auth_methods` string[]
    - object
      - `key-auth` PartialAppAuthStrategyConfigKeyAuth, required — Key Auth configuration for updating an Application Auth Strategy. The ttl field can be set to null to unset the Time-To-Live.
        - `key_names` string[] — The names of the headers containing the API key. You can specify multiple header names.
        - `ttl` object, nullable — Default maximum Time-To-Live for keys created under this strategy. Set to null to unset.
          - `value` integer, required
          - `unit` 'days' | 'weeks' | 'years', required
  - `principals` AuthStrategyPrincipals — Application principal settings for this auth strategy. Runtime effect applies to V3 API Catalog (ACE) portals and applications; stored values may be set for any auth strategy in the organization.
    - `enabled` boolean, required — Whether application principals are enabled for this auth strategy.

## Response `200`

A response containing a single updated application auth strategy object.

- union — A set of plugin configurations that represent how the gateway will perform authentication and authorization for a Product Version. Called “Auth Strategy” for short in the context of portals/applications. The plugins are synced to any Gateway Service that is currently linked or becomes linked to the Product Version.
  - object — Response payload from creating or updating a Key Auth Application Auth Strategy
    - `id` string, uuid, required — Contains a unique identifier used for this resource.
    - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI.
    - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI.
    - `strategy_type` 'key_auth', required
    - `configs` object, required — JSON-B object containing the configuration for the Key Auth strategy
      - `key-auth` AppAuthStrategyConfigKeyAuth, required — The most basic mode to configure an Application Auth Strategy for an API Product Version. Using this mode will allow developers to generate API keys that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for Key Auth.
        - `key_names` string[] — The names of the headers containing the API key. You can specify multiple header names.
        - `ttl` object — Default maximum Time-To-Live for keys created under this strategy.
          - `value` integer, required
          - `unit` 'days' | 'weeks' | 'years', required
    - `active` boolean, required — At least one published entity is using this auth strategy.
    - `dcr_provider` object, nullable, required
      - `id` string, uuid, required — Contains a unique identifier used for this resource.
      - `name` string, required
      - `display_name` string — The display name of the DCR provider. This is used to identify the DCR provider in the Portal UI.
      - `provider_type` 'auth0' | 'azureAd' | 'curity' | 'okta' | 'http' | 'kongIdentity', required — The type of DCR provider.
    - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.
    - `supports_multiple_credentials` boolean — Indicates whether this auth strategy supports multiple credentials. Always `true` for KEY_AUTH.
    - `principals` AuthStrategyPrincipals — Application principal settings for this auth strategy. Runtime effect applies to V3 API Catalog (ACE) portals and applications; stored values may be set for any auth strategy in the organization.
      - `enabled` boolean, required — Whether application principals are enabled for this auth strategy.
  - object — Response payload from creating an OIDC Application Auth Strategy
    - `id` string, uuid, required — Contains a unique identifier used for this resource.
    - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI.
    - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI.
    - `strategy_type` 'openid_connect', required
    - `configs` object, required — JSON-B object containing the configuration for the OIDC strategy
      - `openid-connect` AppAuthStrategyConfigOpenIDConnect, required — A more advanced mode to configure an API Product Version’s Application Auth Strategy. Using this mode will allow developers to use API credentials issued from an external IdP that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for the same Auth Strategy. An OIDC strategy may be used in conjunction with a DCR provider to automatically create the IdP application.
        - `issuer` string, url, required
        - `credential_claim` string[], required
        - `scopes` string[], required
        - `auth_methods` string[], required
    - `active` boolean, required — At least one published entity is using this auth strategy.
    - `dcr_provider` object, nullable, required
      - `id` string, uuid, required — Contains a unique identifier used for this resource.
      - `name` string, required
      - `display_name` string — The display name of the DCR provider. This is used to identify the DCR provider in the Portal UI.
      - `provider_type` 'auth0' | 'azureAd' | 'curity' | 'okta' | 'http' | 'kongIdentity', required — The type of DCR provider.
    - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.
    - `supports_multiple_credentials` boolean — Indicates whether this auth strategy supports multiple credentials. - `true` for Key Auth strategies and when supported for Client Credentials strategies - `false` when not supported for Client Credentials strategies
    - `principals` AuthStrategyPrincipals — Application principal settings for this auth strategy. Runtime effect applies to V3 API Catalog (ACE) portals and applications; stored values may be set for any auth strategy in the organization.
      - `enabled` boolean, required — Whether application principals are enabled for this auth strategy.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/versions/f920f418f552/schema)