---
title: "Update connected account credentials"
method: PUT
path: "/api/v1/connected_accounts"
tags: ["Connected Accounts"]
---

# Update connected account credentials

`PUT /api/v1/connected_accounts`

Updates authentication credentials and configuration for an existing connected account. Modify OAuth tokens, refresh tokens, access scopes, or API configuration settings. Specify the account by ID, or by combination of organization/user, connector, and identifier. Returns the updated account with new token expiry and status information.

## Request body

- ConnectedAccountsUpdateConnectedAccountRequest
  - `connected_account` V1connectedAccountsUpdateConnectedAccount
    - `api_config` object — Updated JSON configuration for API-specific settings. Merges with existing configuration - only provided fields are modified.
    - `authorization_details` ConnectedAccountsAuthorizationDetails
      - `google_dwd` ConnectedAccountsGoogleDWDAuth — Google Domain-Wide Delegation authentication — used for GOOGLE_DWD connections. Send only subject in requests; access_token, scopes, and token_expires_at are response-only.
        - `access_token` string — OAuth access token acquired via the jwt-bearer grant. Present in responses only.
        - `scopes` string[] — OAuth scopes granted to this token. Present in responses only.
        - `subject` string — Email address of the Google Workspace user to impersonate via Domain-Wide Delegation.
        - `token_expires_at` string, date-time — When the access token expires. Present in responses only.
      - `oauth_token` ConnectedAccountsOauthToken
        - `access_token` string — OAuth access token for API requests. Typically short-lived and must be refreshed after expiration.
        - `domain` string — Associated domain for workspace or organization-scoped OAuth connections (e.g., Google Workspace domain).
        - `refresh_token` string — OAuth refresh token for obtaining new access tokens. Long-lived and used to maintain persistent authorization.
        - `scopes` string[] — List of granted OAuth scopes defining the permissions and access levels for this connection.
      - `static_auth` ConnectedAccountsStaticAuth
        - `details` object — Flexible JSON structure containing static credentials. Format varies by connector type (API key, username/password, etc.).
      - `trusted_idp` ConnectedAccountsTrustedIDPAuth — Trusted IDP federated authentication — used for TRUSTED_IDP connections (e.g. AWS Redshift). Send only db_user in requests; cached temporary credentials are managed server-side and returned only on output paths. secret_access_key and session_token are never exposed in public API responses.
        - `access_key_id` string — Federated access key ID issued by the trusted identity provider. Present in responses only.
        - `db_user` string — Target database user for the federated session (required for provisioned Redshift clusters; ignored for serverless workgroups).
        - `expiry` string, date-time — When the federated credentials expire. Present in responses only.
        - `secret_access_key` string — Federated secret access key. Never returned in public API responses.
        - `session_token` string — Federated session token. Never returned in public API responses.
  - `connector` string — Connector identifier (e.g., 'notion', 'slack', 'google'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.
  - `id` string — Unique identifier for the connected account to update
  - `identifier` string — The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).
  - `organization_id` string — Organization ID for the connector
  - `user_id` string — User ID for the connector

## Response `200`

Connected account updated successfully with new credentials or configuration

- ConnectedAccountsUpdateConnectedAccountResponse
  - `connected_account` ConnectedAccountsConnectedAccount
    - `api_config` object — Optional JSON configuration for connector-specific API settings such as rate limits, custom endpoints, or feature flags.
    - `authorization_details` ConnectedAccountsAuthorizationDetails
      - `google_dwd` ConnectedAccountsGoogleDWDAuth — Google Domain-Wide Delegation authentication — used for GOOGLE_DWD connections. Send only subject in requests; access_token, scopes, and token_expires_at are response-only.
        - `access_token` string — OAuth access token acquired via the jwt-bearer grant. Present in responses only.
        - `scopes` string[] — OAuth scopes granted to this token. Present in responses only.
        - `subject` string — Email address of the Google Workspace user to impersonate via Domain-Wide Delegation.
        - `token_expires_at` string, date-time — When the access token expires. Present in responses only.
      - `oauth_token` ConnectedAccountsOauthToken
        - `access_token` string — OAuth access token for API requests. Typically short-lived and must be refreshed after expiration.
        - `domain` string — Associated domain for workspace or organization-scoped OAuth connections (e.g., Google Workspace domain).
        - `refresh_token` string — OAuth refresh token for obtaining new access tokens. Long-lived and used to maintain persistent authorization.
        - `scopes` string[] — List of granted OAuth scopes defining the permissions and access levels for this connection.
      - `static_auth` ConnectedAccountsStaticAuth
        - `details` object — Flexible JSON structure containing static credentials. Format varies by connector type (API key, username/password, etc.).
      - `trusted_idp` ConnectedAccountsTrustedIDPAuth — Trusted IDP federated authentication — used for TRUSTED_IDP connections (e.g. AWS Redshift). Send only db_user in requests; cached temporary credentials are managed server-side and returned only on output paths. secret_access_key and session_token are never exposed in public API responses.
        - `access_key_id` string — Federated access key ID issued by the trusted identity provider. Present in responses only.
        - `db_user` string — Target database user for the federated session (required for provisioned Redshift clusters; ignored for serverless workgroups).
        - `expiry` string, date-time — When the federated credentials expire. Present in responses only.
        - `secret_access_key` string — Federated secret access key. Never returned in public API responses.
        - `session_token` string — Federated session token. Never returned in public API responses.
    - `authorization_type` 'OAUTH' | 'API_KEY' | 'BASIC_AUTH' | 'BEARER_TOKEN' | 'CUSTOM' | 'BASIC' | 'OAUTH_M2M' | 'TRELLO_OAUTH1' | 'GOOGLE_DWD' | 'TRUSTED_IDP' | 'SMART_FHIR' | 'NO_AUTH' — - OAUTH: OAuth 2.0 authorization with access and refresh tokens - API_KEY: Static API key authentication - BASIC_AUTH: HTTP Basic Authentication (username/password) - BEARER_TOKEN: Bearer token authentication - CUSTOM: Custom authentication mechanism - BASIC: Basic authentication (alias) - OAUTH_M2M: OAuth 2.0 client credentials (machine-to-machine) - TRELLO_OAUTH1: Trello token-based OAuth1-style browser authorization - GOOGLE_DWD: Google Domain-Wide Delegation - TRUSTED_IDP: Trusted Identity Provider federation (e.g. AWS STS AssumeRoleWithWebIdentity) - SMART_FHIR: SMART on FHIR (SMART App Launch) — OAuth 2.0 authorization for FHIR servers - NO_AUTH: No authentication — connector requires no credentials (e.g. public docs MCP servers)
    - `connection_id` string — Reference to the parent connection configuration. Links this account to a specific connector setup in your environment.
    - `connector` string — Connector identifier (e.g., 'notion', 'slack', 'salesforce'). Indicates which third-party application this account connects to.
    - `id` string — Unique Scalekit-generated identifier for this connected account. Always prefixed with 'ca_'.
    - `identifier` string — The unique identifier for this account in the third-party service. Typically an email address, user ID, or workspace identifier.
    - `last_used_at` string, date-time — Timestamp when this connected account was last used to make an API call. Useful for tracking active connections.
    - `provider` string — OAuth provider name (e.g., 'google', 'microsoft', 'github'). Identifies which authentication service manages this connection.
    - `status` 'ACTIVE' | 'EXPIRED' | 'PENDING_AUTH' | 'PENDING_VERIFICATION' | 'DISCONNECTED' — - ACTIVE: Account is connected and credentials are valid - EXPIRED: Access token has expired and needs refresh - PENDING_AUTH: Account awaiting user authorization (re-auth initiated) - PENDING_VERIFICATION: OAuth complete; awaiting user identity verification before activation - DISCONNECTED: Account has been manually disconnected
    - `token_expires_at` string, date-time — Expiration timestamp for the access token. After this time, the token must be refreshed or re-authorized.
    - `updated_at` string, date-time — Timestamp when this connected account was last modified. Updated whenever credentials or configuration changes.

## Other responses

- `400` — Invalid request - missing required fields, invalid authorization details, or validation failed
- `401` — Authentication required - missing or invalid access token
- `404` — Connected account not found - the specified account does not exist

---

[API](https://skmtc.net/scalekit/apis/scalekit-api-reference.md) · [All operations](https://skmtc.net/scalekit/apis/scalekit-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/scalekit/scalekit-api-reference/versions/a40d5d4650e5/schema)