---
title: "Update an authentication provider"
method: PATCH
path: "/groups/{groupId}/apps/{appId}/auth_providers/{providerId}"
tags: ["authproviders"]
---

# Update an authentication provider

`PATCH /groups/{groupId}/apps/{appId}/auth_providers/{providerId}`

Update an [authentication provider](https://www.mongodb.com/docs/atlas/app-services/authentication/).

## Request body

- union
  - AnonymousAuthProvider
    - `name` 'anon-user', required — The name of the authentication provider. For Anonymous authentication, this value is always `anon-user`.
    - `type` 'anon-user', required — The name of the authentication provider. For Anonymous authentication, this value is always `anon-user`.
    - `disabled` boolean — If `true`, the auth provider is disabled. Users cannot log in through the provider until it is enabled.
  - EmailPasswordAuthProvider
    - `name` 'local-userpass', required — The name of the authentication provider. For Email/Password authentication, this value is always `local-userpass`.
    - `type` 'local-userpass', required — The name of the authentication provider. For Email/Password authentication, this value is always `local-userpass`.
    - `disabled` boolean — If `true`, the auth provider is disabled. Users cannot log in through the provider until it is enabled.
    - `config` union
      - object
        - `autoConfirm` unknown
        - `resetPasswordUrl` string — The URL included in the email sent to users as part of the built-in password reset flow. The email also adds a unique password reset `token` and `tokenId` as query parameters. This URL should handle user confirmation by passing the password reset token to a Realm SDK's `resetPassword` function.
        - `resetPasswordSubject` string — The subject line of the email sent to users as part of the built-in password reset flow.
      - object
        - `autoConfirm` unknown
        - `runResetFunction` true — If `true`, use a custom function that you define to handle the password reset process.
        - `resetFunctionName` string — The name of the custom function that handles the password reset process.
      - object
        - `autoConfirm` unknown
        - `emailConfirmationUrl` string — The URL included in the email sent to new users as part of the built-in confirmation flow. The email also adds a unique confirmation `token` and `tokenId` as query parameters. This URL should handle user confirmation by passing the confirmation token to a Realm SDK's `confirmUser` function or to the Admin API [Confirm a Pending Email/Password User](#tag/email/operation/adminConfirmPendingUser) endpoint.
        - `confirmEmailSubject` string — The subject line of the email sent to new users as part of the built-in confirmation flow.
        - `resetPasswordUrl` string — The URL included in the email sent to users as part of the built-in password reset flow. The email also adds a unique password reset `token` and `tokenId` as query parameters. This URL should handle user confirmation by passing the password reset token to a Realm SDK's `resetPassword` function.
        - `resetPasswordSubject` string — The subject line of the email sent to users as part of the built-in password reset flow.
      - object
        - `autoConfirm` unknown
        - `emailConfirmationUrl` string — The URL included in the email sent to new users as part of the built-in confirmation flow. The email also adds a unique confirmation `token` and `tokenId` as query parameters. This URL should handle user confirmation by passing the confirmation token to a Realm SDK's `confirmUser` function or to the Admin API [Confirm a Pending Email/Password User](#tag/email/operation/adminConfirmPendingUser) endpoint.
        - `confirmEmailSubject` string — The subject line of the email sent to new users as part of the built-in confirmation flow.
        - `runResetFunction` true — If `true`, use a custom function that you define to handle the password reset process.
        - `resetFunctionName` string — The name of the custom function that handles the password reset process.
      - object
        - `autoConfirm` unknown
        - `runConfirmationFunction` boolean — If `true`, new email/password user account registrations use a custom function that you define to handle the confirmation process.
        - `confirmationFunctionName` string — The name of the custom function that handles the confirmation process.
        - `resetPasswordUrl` string — The URL included in the email sent to users as part of the built-in password reset flow. The email also adds a unique password reset `token` and `tokenId` as query parameters. This URL should handle user confirmation by passing the password reset token to a Realm SDK's `resetPassword` function.
        - `resetPasswordSubject` string — The subject line of the email sent to users as part of the built-in password reset flow.
      - object
        - `autoConfirm` unknown
        - `runConfirmationFunction` boolean — If `true`, new email/password user account registrations use a custom function that you define to handle the confirmation process.
        - `confirmationFunctionName` string — The name of the custom function that handles the confirmation process.
        - `runResetFunction` true — If `true`, use a custom function that you define to handle the password reset process.
        - `resetFunctionName` string — The name of the custom function that handles the password reset process.
  - ApiKeyAuthProvider
    - `name` 'api-key', required — The name of the authentication provider. For API key authentication, this value is always `api-key`.
    - `type` 'api-key', required — The name of the authentication provider. For API key authentication, this value is always `api-key`.
    - `disabled` boolean — If `true`, the auth provider is disabled. Users cannot log in through the provider until it is enabled.
  - CustomJwtAuthProvider
    - `name` 'custom-token', required — The name of the authentication provider. For Custom JWT authentication, this value is always `custom-token`.
    - `type` 'custom-token', required — The name of the authentication provider. For Custom JWT authentication, this value is always `custom-token`.
    - `disabled` boolean — If `true`, the auth provider is disabled. Users cannot log in through the provider until it is enabled.
    - `config` object — A configuration object for the Custom JWT authentication provider.
      - `audience` string[] — Defines the expected values of the `aud` claim in the external JWT. By default, the Custom JWT provider expects `aud` to be your App ID.
      - `requireAnyAudience` string — If `false`, the external JWT must include *all* of the values defined in `audience` in its `aud` claim. If `true`, a JWT is valid if *any* of the values defined in `audience` are in its `aud` claim.
      - `signingAlgorithm` string — The cryptographic method that the external system uses to sign the JWT. Custom JWT authentication supports JWTs signed using any of the following algorithms: - HS256 - RS256
      - `useJWKURI` boolean — If `true`, the Custom JWT provider uses a signing algorithm and signing keys defined in a [JSON Web Key](https://www.rfc-editor.org/rfc/rfc7517) (JWK) or JSON Web Key Set (JWKS). The JWK(S) must be accessible at the URL specified in `jwkURI`.
      - `jwkURI` string — A URL that hosts a JWK or JWKS that describes the signing method and signing keys the Custom JWT provider should use. The JWK(S) may specify up to three signing keys and must use the RS256 algorithm.
    - `secret_config` object
      - `signingKeys` string[]
    - `metadata_fields` object[] — Metadata fields are additional data that describe each user. The value of each metadata field comes from some field included in the JWT from the external authentication system. A user's metadata fields refresh whenever they log in.
      - `required` boolean — If `true`, this value must always be present in the external JWT.
      - `name` string — The name of the field in the external JWT that contains the data. To specify a field in an embedded object, use [dot notation](https://www.mongodb.com/docs/manual/core/document/#dot-notation).
      - `field_name` string — The name of the field in User object that holds the value.
  - CustomFunctionAuthProvider
    - `name` 'custom-function', required — The name of the authentication provider. For Custom Function authentication, this value is always `custom-function`.
    - `type` 'custom-function', required — The name of the authentication provider. For Custom Function authentication, this value is always `custom-function`.
    - `disabled` boolean — If `true`, the auth provider is disabled. Users cannot log in through the provider until it is enabled.
    - `config` object — A configuration object for the Custom Function authentication provider.
      - `authFunctionName` string — The name of the [custom authentication function](https://www.mongodb.com/docs/atlas/app-services/authentication/custom-function/#the-authentication-function) that handles user logins.
  - AppleAuthProvider
    - `name` 'oauth2-apple', required — The name of the authentication provider. For Apple authentication, this value is always `oauth2-apple`.
    - `type` 'oauth2-apple', required — The name of the authentication provider. For Apple authentication, this value is always `oauth2-apple`.
    - `disabled` boolean — If `true`, the auth provider is disabled. Users cannot log in through the provider until it is enabled.
    - `config` object — A configuration object for the Apple authentication provider.
      - `clientId` string — Your Apple Services ID. To learn how to get this, see [Create a Services ID](https://www.mongodb.com/docs/atlas/app-services/authentication/apple/#create-a-services-id).
    - `secret_config` object
      - `clientSecret` string — The name of a [Secret](https://www.mongodb.com/docs/atlas/app-services/values-and-secrets/) that holds your client secret JWT. To learn how to create this, see [Create the Client Secret JWT](https://www.mongodb.com/docs/atlas/app-services/authentication/apple/#create-the-client-secret-jwt).
    - `redirect_uris` string[]
  - GoogleAuthProvider
    - `name` 'oauth2-google', required — The name of the authentication provider. For Google authentication, this value is always `oauth2-google`.
    - `type` 'oauth2-google', required — The name of the authentication provider. For Google authentication, this value is always `oauth2-google`.
    - `disabled` boolean — If `true`, the auth provider is disabled. Users cannot log in through the provider until it is enabled.
    - `config` object — A configuration object for the Google authentication provider.
      - `clientId` string — An OAuth 2.0 Client ID for your GCP project. To learn how to create one, see [Set Up a Project in the Google API Console](https://www.mongodb.com/docs/atlas/app-services/authentication/google/#std-label-auth-gcp-project-setup).
      - `openId` boolean — An OAuth 2.0
    - `secret_config` object
      - `clientSecret` string — The name of a [Secret](https://www.mongodb.com/docs/atlas/app-services/values-and-secrets/) that holds the OAuth 2.0 Client Secret for the Client ID specified in `config.clientId`.
    - `redirect_uris` string[]
    - `metadata_fields` array[]
      - object[] — Metadata fields are additional data that describe each user. The value of each metadata field comes from Google and is included in the authenticated JWT. A user's metadata fields refresh whenever they log in.
        - `required` boolean — If `true`, include this metadata value in the OAuth JWT and the user's data.
        - `name` string — The name of a user metadata property accessible through OAuth, e.g. `email`.
    - `domain_restrictions` string[]
  - FacebookAuthProvider
    - `name` 'oauth2-facebook', required — The name of the authentication provider. For Facebook authentication, this value is always `oauth2-facebook`.
    - `type` 'oauth2-facebook', required — The name of the authentication provider. For Facebook authentication, this value is always `oauth2-facebook`.
    - `disabled` boolean — If `true`, the auth provider is disabled. Users cannot log in through the provider until it is enabled.
    - `config` object — A configuration object for the Facebook authentication provider.
      - `clientId` string — The App ID of your Facebook app.
    - `secret_config` object
      - `clientSecret` string — The name of a [Secret](https://www.mongodb.com/docs/atlas/app-services/values-and-secrets/) that holds your Facebook App Secret.
    - `redirect_uris` string[]
    - `metadata_fields` array[]
      - object[] — Metadata fields are additional data that describe each user. The value of each metadata field comes from Facebook and is included in the authenticated JWT. A user's metadata fields refresh whenever they log in.
        - `required` boolean — If `true`, include this metadata value in the OAuth JWT and the user's data.
        - `name` string — The name of a user metadata property accessible through OAuth, e.g. `email`.
    - `domain_restrictions` string[]

## Response `204`

Successfully updated.

---

[API](https://skmtc.net/mongodb/apis/mongodb-atlas-app-services-admin-api.md) · [All operations](https://skmtc.net/mongodb/apis/mongodb-atlas-app-services-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mongodb/mongodb-atlas-app-services-admin-api/revisions/1365ab72bc03/schema)