---
title: "Replace an auth server client"
method: PUT
path: "/v1/auth-servers/{authServerId}/clients/{clientId}"
tags: ["Auth Server Clients"]
---

# Replace an auth server client

`PUT /v1/auth-servers/{authServerId}/clients/{clientId}`

Replace a client for a given auth server. The client ID and secret can be provided to update an existing client, or to create a client with the matching ID and secret.

## Request body

- object
  - `name` string, required — The name of the client
  - `client_secret` string, required — Secret of the client
  - `grant_types` GrantType[], required — List of OAuth 2.0 grant types
  - `response_types` ResponseType[], required — List of OAuth 2.0 response types
  - `redirect_uris` string[] — The URIs that the client is allowed to redirect to after authentication in interactive flows. All redirect URIs must be absolute URIs, be secure (HTTPS), and must not include a fragment component.
  - `login_uri` string, uri, nullable — The URI of the login page where the user is redirected to authenticate in interactive flows. The login page must be secure (HTTPS).
  - `access_token_duration` integer — The duration of the minted token is valid for, in seconds
  - `id_token_duration` integer — The duration of the minted token is valid for, in seconds
  - `allow_all_scopes` boolean — Specifies whether the client is allowed to request all scopes
  - `allow_scopes` string[] — Specifies the scopes IDs that the client is allowed to request
  - `token_endpoint_auth_method` 'client_secret_post' | 'none' — Requested authentication method for OAuth 2.0 endpoints.
  - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".

## Response `200`

A client

- Client
  - `id` string, required — The OAuth 2.0 client ID
  - `name` string, required — The name of the client
  - `grant_types` GrantType[], required — List of OAuth 2.0 grant types
  - `redirect_uris` string[], required — The URIs that the client is allowed to redirect to after authentication in interactive flows. All redirect URIs must be absolute URIs, be secure (HTTPS), and must not include a fragment component.
  - `login_uri` string, uri, nullable — The URI of the login page where the user is redirected to authenticate in interactive flows. The login page must be secure (HTTPS).
  - `access_token_duration` integer, required — The duration of the minted token is valid for, in seconds
  - `id_token_duration` integer, required — The duration of the minted token is valid for, in seconds
  - `allow_all_scopes` boolean, required — Specifies whether the client is allowed to request all scopes
  - `allow_scopes` string[], required — Specifies the scopes IDs that the client is allowed to request
  - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `response_types` ResponseType[], required — List of OAuth 2.0 response types
  - `token_endpoint_auth_method` 'client_secret_post' | 'none' — Requested authentication method for OAuth 2.0 endpoints.
  - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
  - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.

## Other responses

- `201` — A client
- `400` — Bad Request
- `404` — Not Found
- `409` — Conflict

---

[API](https://skmtc.net/kong/apis/konnect-api.md) · [All operations](https://skmtc.net/kong/apis/konnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api/revisions/06734a9c491f/schema)