---
# @generated by sylphx-gen. Do not edit.
title: "sylphx auth oauth_clients"
description: "The sylphx auth oauth_clients commands of Sylphx Auth: every verb, with its argument, its flags and a run line."
type: reference
product: auth
summary: "Every sylphx auth oauth_clients command: its argument, its flags and a run line."
updated: 2026-09-28
nav: false
---

> **This method is not served on the public API.** `api.sylphx.com` does not route this call: its backend is not deployed behind the public API, or does not implement the call. This page documents the contract. It is kept out of the sidebar and of search engines.

The `oauth_clients` commands of Sylphx Auth, as the CLI spells them: the same
calls as [the `oauth_clients` API page](/docs/api/oauth_clients), typed for the
shell. [Install, sign in and the grammar](/docs/cli) are on the CLI index.

## get

Gets an OAuth client.

**`NAME`** — the resource's name; a bare id is enough below the linked
project.

**CLI**

```bash
sylphx auth oauth-clients get orgs/acme/projects/shop/envs/production/oauth_clients/oauth-client
```

`GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/oauth_clients/oauth-client` · scope `auth:read` · effect `read` · [Request, response and examples](/docs/api/oauth_clients/get)

## list

Lists OAuth clients.

**`PARENT`** — optional: the CLI fills it from the linked project or the
key's scope when it is left out.

**CLI**

```bash
sylphx auth oauth-clients list orgs/acme/projects/shop/envs/production
```

`GET https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/oauth_clients` · scope `auth:read` · effect `read` · [Request, response and examples](/docs/api/oauth_clients/list)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--page-size` | `int` | At most this many; default 50, clamped to 1000. |
| `--page-token` | `string` | `next_page_token` of the previous page. |
| `--filter` | `string` | AIP-160 filter over labels and filterable fields. |
| `--order-by` | `string` | AIP-132 ordering over filterable fields. |

## create

Creates an OAuth client.

**`ID`** — The id segment of the new Resource's name; the server assigns one when omitted.

**CLI**

```bash
sylphx auth oauth-clients create --parent orgs/acme/projects/shop/envs/production --spec.client-type confidential --spec.token-endpoint-auth-method none
```

`POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/oauth_clients` · scope `auth:write` · effect `write` · [Request, response and examples](/docs/api/oauth_clients/create)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--parent` | `string` | The parent to create in; defaults to the linked project or the key's scope. |
| `--meta.labels` | `key=value` | Caller-writable, indexed labels (AIP-122 label rules). Repeat the flag for each value. |
| `--meta.annotations` | `key=value` | Caller-writable, unindexed annotations. Repeat the flag for each value. |
| `--meta.display-name` | `string` | Caller-writable human-readable name. |
| `--spec.client-type` | `enum` | Confidential or public. Required. One of `confidential`, `public`. |
| `--spec.token-endpoint-auth-method` | `enum` | How the client authenticates at the token endpoint. Required. One of `none`, `client_secret_basic`, `private_key_jwt`. |
| `--spec.redirect-uris` | `string` | Exact redirect URIs. Repeat the flag for each value. |
| `--spec.grant-types` | `enum` | Allowed grants. Required. Repeat the flag for each value. One of `authorization_code`, `refresh_token`, `device_code`, `client_credentials`. |
| `--spec.scopes` | `string` | Scopes the client may request. Repeat the flag for each value. |
| `--spec.jwks-uri` | `string` | The client's JWKS URI, for `private_key_jwt`. |
| `--spec.dpop-required` | `bool` | Require DPoP-bound tokens (RFC 9449). |
| `--spec.access-token-ttl` | `duration` | Access token lifetime; default 1h. |
| `--spec.refresh-token-ttl` | `duration` | Refresh token lifetime; default 30d. |
| `--dry-run` | `bool` | Validate and print the result without writing (validate_only). |

## update

Updates an OAuth client.

**`NAME`** — the resource's name; a bare id is enough below the linked
project.

**CLI**

```bash
sylphx auth oauth-clients update orgs/acme/projects/shop/envs/production/oauth_clients/oauth-client --spec.token-endpoint-auth-method none
```

`PATCH https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/oauth_clients/oauth-client` · scope `auth:write` · effect `write` · [Request, response and examples](/docs/api/oauth_clients/update)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--meta.labels` | `key=value` | Caller-writable, indexed labels (AIP-122 label rules). Repeat the flag for each value. |
| `--meta.annotations` | `key=value` | Caller-writable, unindexed annotations. Repeat the flag for each value. |
| `--meta.display-name` | `string` | Caller-writable human-readable name. |
| `--spec.token-endpoint-auth-method` | `enum` | How the client authenticates at the token endpoint. Required. One of `none`, `client_secret_basic`, `private_key_jwt`. |
| `--spec.redirect-uris` | `string` | Exact redirect URIs. Repeat the flag for each value. |
| `--spec.grant-types` | `enum` | Allowed grants. Required. Repeat the flag for each value. One of `authorization_code`, `refresh_token`, `device_code`, `client_credentials`. |
| `--spec.scopes` | `string` | Scopes the client may request. Repeat the flag for each value. |
| `--spec.jwks-uri` | `string` | The client's JWKS URI, for `private_key_jwt`. |
| `--spec.dpop-required` | `bool` | Require DPoP-bound tokens (RFC 9449). |
| `--spec.access-token-ttl` | `duration` | Access token lifetime; default 1h. |
| `--spec.refresh-token-ttl` | `duration` | Refresh token lifetime; default 30d. |
| `--allow-missing` | `bool` | Create the OAuth client when it does not exist (declarative upsert). |
| `--dry-run` | `bool` | Validate and print the result without writing (validate_only). |

## delete

Deletes an OAuth client.

**`NAME`** — the resource's name; a bare id is enough below the linked
project.

**CLI**

```bash
sylphx auth oauth-clients delete orgs/acme/projects/shop/envs/production/oauth_clients/oauth-client --yes
```

`DELETE https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/oauth_clients/oauth-client` · scope `auth:write` · effect `destructive` · [Request, response and examples](/docs/api/oauth_clients/delete)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--etag` | `string` | Delete only if the current etag matches. |
| `--allow-missing` | `bool` | Succeed when the OAuth client does not exist. |
| `--dry-run` | `bool` | Validate and print the result without writing (validate_only). |
| `--yes` | `bool` | Do not ask before this destructive call. |

## roll-secret

Issues a new client secret, returned once; the old one verifies until `grace_period` ends.

**`NAME`** — the resource's name; a bare id is enough below the linked
project.

**CLI**

```bash
sylphx auth oauth-clients roll-secret orgs/acme/projects/shop/envs/production/oauth_clients/oauth-client
```

`POST https://api.sylphx.com/v1/orgs/acme/projects/shop/envs/production/oauth_clients/oauth-client:rollSecret` · scope `auth:write` · effect `write` · [Request, response and examples](/docs/api/oauth_clients/roll_secret)

**Flags**

| Flag | Type | What it does |
| --- | --- | --- |
| `--grace-period` | `duration` | How long the old secret keeps verifying; default 24h. |
| `--etag` | `string` | Act only if the current etag matches. |
| `--dry-run` | `bool` | Validate and print the result without writing (validate_only). |