MCP OAuth Clients

Package: agentrouter.mcp.v1 Service: McpOAuthClientsService

Endpoints

Create an MCP OAuth client

Changed in v0.9.0 (security updates): The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.

Changed in v0.9.0 (new features): Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.

Changed in v0.8.0 (bug fixes): MCP servers whose OAuth client was created through the API now get their sign-in applied on gateways. Their servers were recorded in a form the gateway configuration did not read, so those servers were treated as needing no sign-in. Sign-in details are also now looked up within the project that owns them, so two projects using the same provider name no longer stop each other's MCP servers from signing in.

Changed in v0.5.0 (new features): You can now register and connect an MCP server whose OAuth provider issues public clients, which have no client secret.

Changed in v0.2.0 (bug fixes): The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.

What it does: Registers a new OAuth client under a project. The client_secret is wrapped by the secret service and discarded; only an sm:// reference is persisted.

Request fields:

Field	Required	Description
customer_id	no	Defaults to the caller's session customer when empty.
project_id	no	Defaults to the caller's session project when empty.
provider	yes	Required: stable provider key, e.g. "github".
provider_name	yes	Required: human-friendly provider display name.
client_id	yes	Required: OAuth client id from the provider.
client_secret	no	OAuth client secret. WRITE-ONLY -- wrapped by the secret service and never returned on any response. Required for a confidential client, and rejected for a public one: set metadata token_auth_method="none" instead when the provider issues no secret (PKCE authenticates the exchange).
authorization_url	yes	Required: OAuth authorization endpoint URL.
token_url	yes	Required: OAuth token endpoint URL.
scopes	no	Optional: requested OAuth scopes.
redirect_uris	no	Optional: allowed redirect URIs.
metadata	no	Optional: free-form provider configuration, string values only. Deprecated: use metadata_json. Setting both is an error.
server_ids	no	Optional: MCP server ids this client serves.
status	no	Optional: initial status ("active"	"inactive"). Defaults to "active" when empty.
metadata_json	no	Optional: free-form provider configuration, any JSON values.

Response fields:

Field	Required	Description
id	output-only	Server-assigned uuid row id. Output-only.
customer_id	output-only	Owning customer scope. Defaults to the caller's session customer when empty on the request; immutable once set.
project_id	output-only	Owning project scope. Defaults to the caller's session project when empty on the request; immutable once set.
provider	yes	Stable provider key, e.g. "github", "google". Unique per (customer, project). Required on create.
provider_name	yes	Human-friendly display name for the provider, e.g. "GitHub".
client_id	yes	OAuth client id issued by the upstream provider.
authorization_url	yes	OAuth authorization endpoint URL.
token_url	yes	OAuth token endpoint URL.
scopes	no	OAuth scopes requested during the authorization flow.
redirect_uris	no	Allowed redirect URIs for the authorization-code flow.
metadata	no	The string values of metadata_json. Deprecated: it drops arrays and objects (server_ids, user_scopes, auth_params, ...); read metadata_json.
server_ids	no	MCP server ids this client serves, besides the server whose id equals provider. Empty means that server only.
status	no	Lifecycle status: "active"	"inactive"	"revoked".
created_at	output-only	Row creation time. Output-only.
updated_at	output-only	Last mutation time. Output-only.
metadata_json	no	Free-form provider configuration (discovery_url, token_auth_method, server_ids, user_scopes, ...), as stored in the metadata column.

{"signatures":{"go":"func (x *McpOAuthClientsClient) CreateMcpOAuthClient(ctx context.Context, req *mcpv1.CreateMcpOAuthClientRequest) (*mcpv1.McpOAuthClient, error)","python":"create_mcp_oauth_client(req: mcp_oauth_clients_pb2.CreateMcpOAuthClientRequest) -\u003e McpOAuthClient","typescript":"createMcpOAuthClient(req: MessageInitShape\u003ctypeof tars_mcp_v1_mcp_oauth_clients_pb.CreateMcpOAuthClientRequestSchema\u003e): Promise\u003cMcpOAuthClient\u003e","cli":"tare api mcp oauth-clients create --provider $PROVIDER --provider-name $PROVIDER_NAME --client-id $CLIENT_ID --authorization-url $AUTHORIZATION_URL --token-url $TOKEN_URL","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/v1/customers/cust_01H.../projects/proj_01H.../mcp-oauth-clients\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"provider\": \"...\",\n    \"provider_name\": \"...\",\n    \"client_id\": \"...\",\n    \"client_secret\": \"...\",\n    \"authorization_url\": \"...\",\n    \"token_url\": \"...\",\n    \"scopes\": [],\n    \"redirect_uris\": [],\n    \"metadata\": {},\n    \"server_ids\": [],\n    \"status\": \"...\",\n    \"metadata_json\": {}\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tmcpv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/mcp/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026mcpv1.CreateMcpOAuthClientRequest{}\n\n\tresp, err := client.McpOAuthClients().CreateMcpOAuthClient(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/mcpoauthclients/createmcpoauthclient\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.mcp.v1 import mcp_oauth_clients_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = mcp_oauth_clients_pb2.CreateMcpOAuthClientRequest()\ntry:\n    result = client.mcp_oauth_clients.create_mcp_oauth_client(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.mcpOauthClients.createMcpOAuthClient(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"mcpoauthclients\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"cli":"tare api mcp oauth-clients create --provider $PROVIDER --provider-name $PROVIDER_NAME --client-id $CLIENT_ID --authorization-url $AUTHORIZATION_URL --token-url $TOKEN_URL","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/v1/customers/cust_01H.../projects/proj_01H.../mcp-oauth-clients\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"provider\": \"...\",\n    \"provider_name\": \"...\",\n    \"client_id\": \"...\",\n    \"client_secret\": \"...\",\n    \"authorization_url\": \"...\",\n    \"token_url\": \"...\",\n    \"scopes\": [],\n    \"redirect_uris\": [],\n    \"metadata\": {},\n    \"server_ids\": [],\n    \"status\": \"...\",\n    \"metadata_json\": {}\n  }'"},"persona":"Authenticated (API key or session token)","httpVerb":"POST","httpPath":"/v1/customers/{customer_id}/projects/{project_id}/mcp-oauth-clients","slug":"create-an-mcp-oauth-client"}

---

Get an MCP OAuth client

Changed in v0.9.0 (security updates): The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.

Changed in v0.9.0 (new features): Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.

Changed in v0.2.0 (bug fixes): The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.

What it does: Returns a single OAuth client by id. Never returns the client_secret. Account tier: any project member may read.

Request fields:

Field	Required	Description
customer_id	no	Defaults to the caller's session customer when empty.
project_id	no	Defaults to the caller's session project when empty.
id	yes	Required: uuid of the client to fetch (McpOAuthClient.id).

Response fields:

Field	Required	Description
id	output-only	Server-assigned uuid row id. Output-only.
customer_id	output-only	Owning customer scope. Defaults to the caller's session customer when empty on the request; immutable once set.
project_id	output-only	Owning project scope. Defaults to the caller's session project when empty on the request; immutable once set.
provider	yes	Stable provider key, e.g. "github", "google". Unique per (customer, project). Required on create.
provider_name	yes	Human-friendly display name for the provider, e.g. "GitHub".
client_id	yes	OAuth client id issued by the upstream provider.
authorization_url	yes	OAuth authorization endpoint URL.
token_url	yes	OAuth token endpoint URL.
scopes	no	OAuth scopes requested during the authorization flow.
redirect_uris	no	Allowed redirect URIs for the authorization-code flow.
metadata	no	The string values of metadata_json. Deprecated: it drops arrays and objects (server_ids, user_scopes, auth_params, ...); read metadata_json.
server_ids	no	MCP server ids this client serves, besides the server whose id equals provider. Empty means that server only.
status	no	Lifecycle status: "active"	"inactive"	"revoked".
created_at	output-only	Row creation time. Output-only.
updated_at	output-only	Last mutation time. Output-only.
metadata_json	no	Free-form provider configuration (discovery_url, token_auth_method, server_ids, user_scopes, ...), as stored in the metadata column.

{"signatures":{"go":"func (x *McpOAuthClientsClient) GetMcpOAuthClient(ctx context.Context, req *mcpv1.GetMcpOAuthClientRequest) (*mcpv1.McpOAuthClient, error)","python":"get_mcp_oauth_client(req: mcp_oauth_clients_pb2.GetMcpOAuthClientRequest) -\u003e McpOAuthClient","typescript":"getMcpOAuthClient(req: MessageInitShape\u003ctypeof tars_mcp_v1_mcp_oauth_clients_pb.GetMcpOAuthClientRequestSchema\u003e): Promise\u003cMcpOAuthClient\u003e","cli":"tare api mcp oauth-clients get \u003cid\u003e","curl":"curl \"${AGENTROUTER_BASE_URL}/v1/customers/cust_01H.../projects/proj_01H.../mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tmcpv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/mcp/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026mcpv1.GetMcpOAuthClientRequest{}\n\n\tresp, err := client.McpOAuthClients().GetMcpOAuthClient(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/mcpoauthclients/getmcpoauthclient\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.mcp.v1 import mcp_oauth_clients_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = mcp_oauth_clients_pb2.GetMcpOAuthClientRequest()\ntry:\n    result = client.mcp_oauth_clients.get_mcp_oauth_client(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.mcpOauthClients.getMcpOAuthClient(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"mcpoauthclients\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"cli":"tare api mcp oauth-clients get \u003cid\u003e","curl":"curl \"${AGENTROUTER_BASE_URL}/v1/customers/cust_01H.../projects/proj_01H.../mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"GET","httpPath":"/v1/customers/{customer_id}/projects/{project_id}/mcp-oauth-clients/{id}","slug":"get-an-mcp-oauth-client"}

---

List MCP OAuth clients

Changed in v0.9.0 (security updates): The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.

Changed in v0.9.0 (new features): Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.

Changed in v0.2.0 (bug fixes): The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.

What it does: Lists every non-deleted OAuth client in the (customer, project) scope. Account tier: any project member may read.

Request fields:

Field	Required	Description
customer_id	no	Defaults to the caller's session customer when empty.
project_id	no	Defaults to the caller's session project when empty.
page	no	Cursor-pagination inputs (page size + continuation token).

Response fields:

Field	Required	Description
clients	no	OAuth clients in the requested scope (metadata only, no secrets).
page	no	Cursor-pagination outputs (next-page token).

{"signatures":{"go":"func (x *McpOAuthClientsClient) ListMcpOAuthClients(ctx context.Context, req *mcpv1.ListMcpOAuthClientsRequest) (*mcpv1.ListMcpOAuthClientsResponse, error)","python":"list_mcp_oauth_clients(req: mcp_oauth_clients_pb2.ListMcpOAuthClientsRequest) -\u003e ListMcpOAuthClientsResponse","typescript":"listMcpOAuthClients(req: MessageInitShape\u003ctypeof tars_mcp_v1_mcp_oauth_clients_pb.ListMcpOAuthClientsRequestSchema\u003e): Promise\u003cListMcpOAuthClientsResponse\u003e","cli":"tare api mcp oauth-clients list","curl":"curl \"${AGENTROUTER_BASE_URL}/v1/customers/cust_01H.../projects/proj_01H.../mcp-oauth-clients\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tmcpv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/mcp/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026mcpv1.ListMcpOAuthClientsRequest{}\n\n\tresp, err := client.McpOAuthClients().ListMcpOAuthClients(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/mcpoauthclients/listmcpoauthclients\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.mcp.v1 import mcp_oauth_clients_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = mcp_oauth_clients_pb2.ListMcpOAuthClientsRequest()\ntry:\n    result = client.mcp_oauth_clients.list_mcp_oauth_clients(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.mcpOauthClients.listMcpOAuthClients(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"mcpoauthclients\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"cli":"tare api mcp oauth-clients list","curl":"curl \"${AGENTROUTER_BASE_URL}/v1/customers/cust_01H.../projects/proj_01H.../mcp-oauth-clients\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"GET","httpPath":"/v1/customers/{customer_id}/projects/{project_id}/mcp-oauth-clients","slug":"list-mcp-oauth-clients"}

---

Update an MCP OAuth client

Changed in v0.9.0 (security updates): The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.

Changed in v0.9.0 (new features): Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.

Changed in v0.8.0 (bug fixes): MCP servers whose OAuth client was created through the API now get their sign-in applied on gateways. Their servers were recorded in a form the gateway configuration did not read, so those servers were treated as needing no sign-in. Sign-in details are also now looked up within the project that owns them, so two projects using the same provider name no longer stop each other's MCP servers from signing in.

Changed in v0.5.0 (new features): You can now register and connect an MCP server whose OAuth provider issues public clients, which have no client secret.

Changed in v0.2.0 (bug fixes): The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.

What it does: Applies a partial patch. Omitted scalar strings ("") leave the existing value untouched. A non-empty client_secret is stored under a new secret name; the previous secret is deleted once no live client uses it. Changing token_url or authorization_url of a confidential client requires client_secret in the same request, so the stored secret never goes to an endpoint it was not entered for.

Request fields:

Field	Required	Description
customer_id	no	Defaults to the caller's session customer when empty.
project_id	no	Defaults to the caller's session project when empty.
id	yes	Required: uuid of the client to update (McpOAuthClient.id).
provider_name	no	Mutable scalar fields. Empty string leaves the existing value untouched.
client_id	no	undocumented
client_secret	no	Optional: a non-empty value rotates the wrapped client secret in place. Empty leaves the stored secret untouched. WRITE-ONLY.
authorization_url	no	undocumented
token_url	no	undocumented
status	no	undocumented
scopes	no	Repeated / map fields: a non-nil value REPLACES the stored value; a nil/omitted value leaves it untouched (see the replace_* flags).
redirect_uris	no	undocumented
metadata	no	undocumented
server_ids	no	undocumented
replace_scopes	no	Because proto3 cannot distinguish an omitted repeated/map field from an explicit "set to empty", these booleans opt in to clearing the matching collection. When false, an empty scopes/redirect_uris/ metadata/server_ids is treated as "leave untouched".
replace_redirect_uris	no	undocumented
replace_metadata	no	undocumented
replace_server_ids	no	undocumented
metadata_json	no	When set, replaces the stored metadata with any JSON values. It cannot be combined with metadata or replace_metadata.

Response fields:

Field	Required	Description
id	output-only	Server-assigned uuid row id. Output-only.
customer_id	output-only	Owning customer scope. Defaults to the caller's session customer when empty on the request; immutable once set.
project_id	output-only	Owning project scope. Defaults to the caller's session project when empty on the request; immutable once set.
provider	yes	Stable provider key, e.g. "github", "google". Unique per (customer, project). Required on create.
provider_name	yes	Human-friendly display name for the provider, e.g. "GitHub".
client_id	yes	OAuth client id issued by the upstream provider.
authorization_url	yes	OAuth authorization endpoint URL.
token_url	yes	OAuth token endpoint URL.
scopes	no	OAuth scopes requested during the authorization flow.
redirect_uris	no	Allowed redirect URIs for the authorization-code flow.
metadata	no	The string values of metadata_json. Deprecated: it drops arrays and objects (server_ids, user_scopes, auth_params, ...); read metadata_json.
server_ids	no	MCP server ids this client serves, besides the server whose id equals provider. Empty means that server only.
status	no	Lifecycle status: "active"	"inactive"	"revoked".
created_at	output-only	Row creation time. Output-only.
updated_at	output-only	Last mutation time. Output-only.
metadata_json	no	Free-form provider configuration (discovery_url, token_auth_method, server_ids, user_scopes, ...), as stored in the metadata column.

{"signatures":{"go":"func (x *McpOAuthClientsClient) UpdateMcpOAuthClient(ctx context.Context, req *mcpv1.UpdateMcpOAuthClientRequest) (*mcpv1.McpOAuthClient, error)","python":"update_mcp_oauth_client(req: mcp_oauth_clients_pb2.UpdateMcpOAuthClientRequest) -\u003e McpOAuthClient","typescript":"updateMcpOAuthClient(req: MessageInitShape\u003ctypeof tars_mcp_v1_mcp_oauth_clients_pb.UpdateMcpOAuthClientRequestSchema\u003e): Promise\u003cMcpOAuthClient\u003e","cli":"tare api mcp oauth-clients update --id $ID","curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/v1/customers/cust_01H.../projects/proj_01H.../mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"provider_name\": \"...\",\n    \"client_id\": \"...\",\n    \"client_secret\": \"...\",\n    \"authorization_url\": \"...\",\n    \"token_url\": \"...\",\n    \"status\": \"...\",\n    \"scopes\": [],\n    \"redirect_uris\": [],\n    \"metadata\": {},\n    \"server_ids\": [],\n    \"replace_scopes\": false,\n    \"replace_redirect_uris\": false,\n    \"replace_metadata\": false,\n    \"replace_server_ids\": false,\n    \"metadata_json\": {}\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tmcpv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/mcp/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026mcpv1.UpdateMcpOAuthClientRequest{}\n\n\tresp, err := client.McpOAuthClients().UpdateMcpOAuthClient(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/mcpoauthclients/updatemcpoauthclient\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.mcp.v1 import mcp_oauth_clients_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = mcp_oauth_clients_pb2.UpdateMcpOAuthClientRequest()\ntry:\n    result = client.mcp_oauth_clients.update_mcp_oauth_client(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.mcpOauthClients.updateMcpOAuthClient(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"mcpoauthclients\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"cli":"tare api mcp oauth-clients update --id $ID","curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/v1/customers/cust_01H.../projects/proj_01H.../mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"provider_name\": \"...\",\n    \"client_id\": \"...\",\n    \"client_secret\": \"...\",\n    \"authorization_url\": \"...\",\n    \"token_url\": \"...\",\n    \"status\": \"...\",\n    \"scopes\": [],\n    \"redirect_uris\": [],\n    \"metadata\": {},\n    \"server_ids\": [],\n    \"replace_scopes\": false,\n    \"replace_redirect_uris\": false,\n    \"replace_metadata\": false,\n    \"replace_server_ids\": false,\n    \"metadata_json\": {}\n  }'"},"persona":"Authenticated (API key or session token)","httpVerb":"PATCH","httpPath":"/v1/customers/{customer_id}/projects/{project_id}/mcp-oauth-clients/{id}","slug":"update-an-mcp-oauth-client"}

---

Delete an MCP OAuth client

Changed in v0.9.0 (security updates): The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.

Changed in v0.2.0 (bug fixes): The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.

What it does: Soft-deletes a client (deleted_at set).

Request fields:

Field	Required	Description
customer_id	no	Defaults to the caller's session customer when empty.
project_id	no	Defaults to the caller's session project when empty.
id	yes	Required: uuid of the client to soft-delete (McpOAuthClient.id).

{"signatures":{"go":"func (x *McpOAuthClientsClient) DeleteMcpOAuthClient(ctx context.Context, req *mcpv1.DeleteMcpOAuthClientRequest) error","python":"delete_mcp_oauth_client(req: mcp_oauth_clients_pb2.DeleteMcpOAuthClientRequest) -\u003e None","typescript":"deleteMcpOAuthClient(req: MessageInitShape\u003ctypeof tars_mcp_v1_mcp_oauth_clients_pb.DeleteMcpOAuthClientRequestSchema\u003e): Promise\u003cvoid\u003e","cli":"tare api mcp oauth-clients delete \u003cid\u003e","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/v1/customers/cust_01H.../projects/proj_01H.../mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tmcpv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/mcp/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026mcpv1.DeleteMcpOAuthClientRequest{}\n\n\tif err := client.McpOAuthClients().DeleteMcpOAuthClient(ctx, req); err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Println(\"ok\")\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/mcpoauthclients/deletemcpoauthclient\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.mcp.v1 import mcp_oauth_clients_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = mcp_oauth_clients_pb2.DeleteMcpOAuthClientRequest()\ntry:\n    result = client.mcp_oauth_clients.delete_mcp_oauth_client(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.mcpOauthClients.deleteMcpOAuthClient(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"mcpoauthclients\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"cli":"tare api mcp oauth-clients delete \u003cid\u003e","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/v1/customers/cust_01H.../projects/proj_01H.../mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Authenticated (API key or session token)","httpVerb":"DELETE","httpPath":"/v1/customers/{customer_id}/projects/{project_id}/mcp-oauth-clients/{id}","slug":"delete-an-mcp-oauth-client"}

---

List the deployment's shared MCP OAuth clients

Changed in v0.9.0 (new features): Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.

What it does: Lists the deployment's shared OAuth clients: the ('default', 'default') rows every project can sign in through, which the Admin Console manages. Offset paging, because the console shows page numbers. Never returns a client_secret.

Request fields:

Field	Required	Description
search	no	Case-insensitive substring match over provider, provider_name and client_id. %, _ and \ match literally.
status	no	Filter by status: "active", "inactive" or "revoked". Empty means all.
order_by	no	Sort key: "provider_name" (the default), "client_id", "status" or "updated_at". Ties break by id.
order_direction	no	"asc" (the default) or "desc".
offset	no	Rows to skip.
page_size	no	Rows to return: default 10, at most 100.
include_stats	no	When true the response carries stats.

Response fields:

Field	Required	Description
clients	no	undocumented
total_count	no	Clients matching the filters, across all pages.
stats	no	Present only when the request set include_stats.

{"signatures":{"go":"func (x *McpOAuthClientsClient) ListDeploymentMcpOAuthClients(ctx context.Context, req *mcpv1.ListDeploymentMcpOAuthClientsRequest) (*mcpv1.ListDeploymentMcpOAuthClientsResponse, error)","python":"list_deployment_mcp_oauth_clients(req: mcp_oauth_clients_pb2.ListDeploymentMcpOAuthClientsRequest) -\u003e ListDeploymentMcpOAuthClientsResponse","typescript":"listDeploymentMcpOAuthClients(req: MessageInitShape\u003ctypeof tars_mcp_v1_mcp_oauth_clients_pb.ListDeploymentMcpOAuthClientsRequestSchema\u003e): Promise\u003cListDeploymentMcpOAuthClientsResponse\u003e","curl":"curl \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tmcpv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/mcp/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026mcpv1.ListDeploymentMcpOAuthClientsRequest{}\n\n\tresp, err := client.McpOAuthClients().ListDeploymentMcpOAuthClients(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/mcpoauthclients/listdeploymentmcpoauthclients\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.mcp.v1 import mcp_oauth_clients_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = mcp_oauth_clients_pb2.ListDeploymentMcpOAuthClientsRequest()\ntry:\n    result = client.mcp_oauth_clients.list_deployment_mcp_oauth_clients(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.mcpOauthClients.listDeploymentMcpOAuthClients(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"mcpoauthclients\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Admin","httpVerb":"GET","httpPath":"/v1/mcp-oauth-clients","slug":"list-the-deployments-shared-mcp-oauth-clients"}

---

Get a shared MCP OAuth client

Changed in v0.9.0 (new features): Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.

What it does: Returns one shared OAuth client. Never returns the client_secret.

Request fields:

Field	Required	Description
id	yes	Required: uuid of the client (McpOAuthClient.id).

Response fields:

Field	Required	Description
id	output-only	Server-assigned uuid row id. Output-only.
customer_id	output-only	Owning customer scope. Defaults to the caller's session customer when empty on the request; immutable once set.
project_id	output-only	Owning project scope. Defaults to the caller's session project when empty on the request; immutable once set.
provider	yes	Stable provider key, e.g. "github", "google". Unique per (customer, project). Required on create.
provider_name	yes	Human-friendly display name for the provider, e.g. "GitHub".
client_id	yes	OAuth client id issued by the upstream provider.
authorization_url	yes	OAuth authorization endpoint URL.
token_url	yes	OAuth token endpoint URL.
scopes	no	OAuth scopes requested during the authorization flow.
redirect_uris	no	Allowed redirect URIs for the authorization-code flow.
metadata	no	The string values of metadata_json. Deprecated: it drops arrays and objects (server_ids, user_scopes, auth_params, ...); read metadata_json.
server_ids	no	MCP server ids this client serves, besides the server whose id equals provider. Empty means that server only.
status	no	Lifecycle status: "active"	"inactive"	"revoked".
created_at	output-only	Row creation time. Output-only.
updated_at	output-only	Last mutation time. Output-only.
metadata_json	no	Free-form provider configuration (discovery_url, token_auth_method, server_ids, user_scopes, ...), as stored in the metadata column.

{"signatures":{"go":"func (x *McpOAuthClientsClient) GetDeploymentMcpOAuthClient(ctx context.Context, req *mcpv1.GetDeploymentMcpOAuthClientRequest) (*mcpv1.McpOAuthClient, error)","python":"get_deployment_mcp_oauth_client(req: mcp_oauth_clients_pb2.GetDeploymentMcpOAuthClientRequest) -\u003e McpOAuthClient","typescript":"getDeploymentMcpOAuthClient(req: MessageInitShape\u003ctypeof tars_mcp_v1_mcp_oauth_clients_pb.GetDeploymentMcpOAuthClientRequestSchema\u003e): Promise\u003cMcpOAuthClient\u003e","curl":"curl \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tmcpv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/mcp/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026mcpv1.GetDeploymentMcpOAuthClientRequest{}\n\n\tresp, err := client.McpOAuthClients().GetDeploymentMcpOAuthClient(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/mcpoauthclients/getdeploymentmcpoauthclient\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.mcp.v1 import mcp_oauth_clients_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = mcp_oauth_clients_pb2.GetDeploymentMcpOAuthClientRequest()\ntry:\n    result = client.mcp_oauth_clients.get_deployment_mcp_oauth_client(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.mcpOauthClients.getDeploymentMcpOAuthClient(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"mcpoauthclients\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Admin","httpVerb":"GET","httpPath":"/v1/mcp-oauth-clients/{id}","slug":"get-a-shared-mcp-oauth-client"}

---

Create a shared MCP OAuth client

Changed in v0.9.0 (new features): Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.

What it does: Adds a shared OAuth client. Its provider must not be used by a live project client. The row keeps the Admin Console's storage shape, so the console can still read it.

Request fields:

Field	Required	Description
provider	yes	undocumented
provider_name	yes	undocumented
client_id	yes	undocumented
client_secret	no	WRITE-ONLY. Required unless metadata_json token_auth_method is "none".
authorization_url	yes	undocumented
token_url	yes	undocumented
scopes	no	undocumented
redirect_uris	no	undocumented
metadata_json	no	undocumented
server_ids	no	undocumented
status	no	"active" (the default) or "inactive".

Response fields:

Field	Required	Description
id	output-only	Server-assigned uuid row id. Output-only.
customer_id	output-only	Owning customer scope. Defaults to the caller's session customer when empty on the request; immutable once set.
project_id	output-only	Owning project scope. Defaults to the caller's session project when empty on the request; immutable once set.
provider	yes	Stable provider key, e.g. "github", "google". Unique per (customer, project). Required on create.
provider_name	yes	Human-friendly display name for the provider, e.g. "GitHub".
client_id	yes	OAuth client id issued by the upstream provider.
authorization_url	yes	OAuth authorization endpoint URL.
token_url	yes	OAuth token endpoint URL.
scopes	no	OAuth scopes requested during the authorization flow.
redirect_uris	no	Allowed redirect URIs for the authorization-code flow.
metadata	no	The string values of metadata_json. Deprecated: it drops arrays and objects (server_ids, user_scopes, auth_params, ...); read metadata_json.
server_ids	no	MCP server ids this client serves, besides the server whose id equals provider. Empty means that server only.
status	no	Lifecycle status: "active"	"inactive"	"revoked".
created_at	output-only	Row creation time. Output-only.
updated_at	output-only	Last mutation time. Output-only.
metadata_json	no	Free-form provider configuration (discovery_url, token_auth_method, server_ids, user_scopes, ...), as stored in the metadata column.

{"signatures":{"go":"func (x *McpOAuthClientsClient) CreateDeploymentMcpOAuthClient(ctx context.Context, req *mcpv1.CreateDeploymentMcpOAuthClientRequest) (*mcpv1.McpOAuthClient, error)","python":"create_deployment_mcp_oauth_client(req: mcp_oauth_clients_pb2.CreateDeploymentMcpOAuthClientRequest) -\u003e McpOAuthClient","typescript":"createDeploymentMcpOAuthClient(req: MessageInitShape\u003ctypeof tars_mcp_v1_mcp_oauth_clients_pb.CreateDeploymentMcpOAuthClientRequestSchema\u003e): Promise\u003cMcpOAuthClient\u003e","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"provider\": \"...\",\n    \"provider_name\": \"...\",\n    \"client_id\": \"...\",\n    \"client_secret\": \"...\",\n    \"authorization_url\": \"...\",\n    \"token_url\": \"...\",\n    \"scopes\": [],\n    \"redirect_uris\": [],\n    \"metadata_json\": {},\n    \"server_ids\": [],\n    \"status\": \"...\"\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tmcpv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/mcp/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026mcpv1.CreateDeploymentMcpOAuthClientRequest{}\n\n\tresp, err := client.McpOAuthClients().CreateDeploymentMcpOAuthClient(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/mcpoauthclients/createdeploymentmcpoauthclient\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.mcp.v1 import mcp_oauth_clients_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = mcp_oauth_clients_pb2.CreateDeploymentMcpOAuthClientRequest()\ntry:\n    result = client.mcp_oauth_clients.create_deployment_mcp_oauth_client(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.mcpOauthClients.createDeploymentMcpOAuthClient(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"mcpoauthclients\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"provider\": \"...\",\n    \"provider_name\": \"...\",\n    \"client_id\": \"...\",\n    \"client_secret\": \"...\",\n    \"authorization_url\": \"...\",\n    \"token_url\": \"...\",\n    \"scopes\": [],\n    \"redirect_uris\": [],\n    \"metadata_json\": {},\n    \"server_ids\": [],\n    \"status\": \"...\"\n  }'"},"persona":"Admin","httpVerb":"POST","httpPath":"/v1/mcp-oauth-clients","slug":"create-a-shared-mcp-oauth-client"}

---

Update a shared MCP OAuth client

Changed in v0.9.0 (security updates): The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.

Changed in v0.9.0 (new features): Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.

What it does: Patches a shared OAuth client, with the rules of UpdateMcpOAuthClient. A new client_secret replaces the stored one, and the previous secret is deleted once no live client uses it.

Request fields:

Field	Required	Description
id	yes	undocumented
provider_name	no	undocumented
client_id	no	undocumented
client_secret	no	WRITE-ONLY. A non-empty value replaces the stored secret.
authorization_url	no	undocumented
token_url	no	undocumented
status	no	undocumented
scopes	no	undocumented
redirect_uris	no	undocumented
metadata_json	no	undocumented
server_ids	no	undocumented
replace_scopes	no	undocumented
replace_redirect_uris	no	undocumented
replace_server_ids	no	undocumented

Response fields:

Field	Required	Description
id	output-only	Server-assigned uuid row id. Output-only.
customer_id	output-only	Owning customer scope. Defaults to the caller's session customer when empty on the request; immutable once set.
project_id	output-only	Owning project scope. Defaults to the caller's session project when empty on the request; immutable once set.
provider	yes	Stable provider key, e.g. "github", "google". Unique per (customer, project). Required on create.
provider_name	yes	Human-friendly display name for the provider, e.g. "GitHub".
client_id	yes	OAuth client id issued by the upstream provider.
authorization_url	yes	OAuth authorization endpoint URL.
token_url	yes	OAuth token endpoint URL.
scopes	no	OAuth scopes requested during the authorization flow.
redirect_uris	no	Allowed redirect URIs for the authorization-code flow.
metadata	no	The string values of metadata_json. Deprecated: it drops arrays and objects (server_ids, user_scopes, auth_params, ...); read metadata_json.
server_ids	no	MCP server ids this client serves, besides the server whose id equals provider. Empty means that server only.
status	no	Lifecycle status: "active"	"inactive"	"revoked".
created_at	output-only	Row creation time. Output-only.
updated_at	output-only	Last mutation time. Output-only.
metadata_json	no	Free-form provider configuration (discovery_url, token_auth_method, server_ids, user_scopes, ...), as stored in the metadata column.

{"signatures":{"go":"func (x *McpOAuthClientsClient) UpdateDeploymentMcpOAuthClient(ctx context.Context, req *mcpv1.UpdateDeploymentMcpOAuthClientRequest) (*mcpv1.McpOAuthClient, error)","python":"update_deployment_mcp_oauth_client(req: mcp_oauth_clients_pb2.UpdateDeploymentMcpOAuthClientRequest) -\u003e McpOAuthClient","typescript":"updateDeploymentMcpOAuthClient(req: MessageInitShape\u003ctypeof tars_mcp_v1_mcp_oauth_clients_pb.UpdateDeploymentMcpOAuthClientRequestSchema\u003e): Promise\u003cMcpOAuthClient\u003e","curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"provider_name\": \"...\",\n    \"client_id\": \"...\",\n    \"client_secret\": \"...\",\n    \"authorization_url\": \"...\",\n    \"token_url\": \"...\",\n    \"status\": \"...\",\n    \"scopes\": [],\n    \"redirect_uris\": [],\n    \"metadata_json\": {},\n    \"server_ids\": [],\n    \"replace_scopes\": false,\n    \"replace_redirect_uris\": false,\n    \"replace_server_ids\": false\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tmcpv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/mcp/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026mcpv1.UpdateDeploymentMcpOAuthClientRequest{}\n\n\tresp, err := client.McpOAuthClients().UpdateDeploymentMcpOAuthClient(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/mcpoauthclients/updatedeploymentmcpoauthclient\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.mcp.v1 import mcp_oauth_clients_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = mcp_oauth_clients_pb2.UpdateDeploymentMcpOAuthClientRequest()\ntry:\n    result = client.mcp_oauth_clients.update_deployment_mcp_oauth_client(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.mcpOauthClients.updateDeploymentMcpOAuthClient(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"mcpoauthclients\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X PATCH \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"provider_name\": \"...\",\n    \"client_id\": \"...\",\n    \"client_secret\": \"...\",\n    \"authorization_url\": \"...\",\n    \"token_url\": \"...\",\n    \"status\": \"...\",\n    \"scopes\": [],\n    \"redirect_uris\": [],\n    \"metadata_json\": {},\n    \"server_ids\": [],\n    \"replace_scopes\": false,\n    \"replace_redirect_uris\": false,\n    \"replace_server_ids\": false\n  }'"},"persona":"Admin","httpVerb":"PATCH","httpPath":"/v1/mcp-oauth-clients/{id}","slug":"update-a-shared-mcp-oauth-client"}

---

Delete a shared MCP OAuth client

Changed in v0.9.0 (new features): Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.

What it does: Soft-deletes a shared OAuth client and deletes its secret once no live client uses it.

Request fields:

Field	Required	Description
id	yes	undocumented

{"signatures":{"go":"func (x *McpOAuthClientsClient) DeleteDeploymentMcpOAuthClient(ctx context.Context, req *mcpv1.DeleteDeploymentMcpOAuthClientRequest) error","python":"delete_deployment_mcp_oauth_client(req: mcp_oauth_clients_pb2.DeleteDeploymentMcpOAuthClientRequest) -\u003e None","typescript":"deleteDeploymentMcpOAuthClient(req: MessageInitShape\u003ctypeof tars_mcp_v1_mcp_oauth_clients_pb.DeleteDeploymentMcpOAuthClientRequestSchema\u003e): Promise\u003cvoid\u003e","curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tmcpv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/mcp/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026mcpv1.DeleteDeploymentMcpOAuthClientRequest{}\n\n\tif err := client.McpOAuthClients().DeleteDeploymentMcpOAuthClient(ctx, req); err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Println(\"ok\")\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/mcpoauthclients/deletedeploymentmcpoauthclient\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.mcp.v1 import mcp_oauth_clients_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = mcp_oauth_clients_pb2.DeleteDeploymentMcpOAuthClientRequest()\ntry:\n    result = client.mcp_oauth_clients.delete_deployment_mcp_oauth_client(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.mcpOauthClients.deleteDeploymentMcpOAuthClient(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"mcpoauthclients\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X DELETE \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients/01H...\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\""},"persona":"Admin","httpVerb":"DELETE","httpPath":"/v1/mcp-oauth-clients/{id}","slug":"delete-a-shared-mcp-oauth-client"}

---

Exchange an OAuth code through a shared MCP OAuth client

Changed in v0.9.0 (new features): Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.

What it does: Completes a sign-in through a shared client: it trades the authorization code for an access token at the client's token endpoint and returns the access token. It never returns a refresh token, and valet stores nothing. The Admin Console uses it to list an MCP server's tools. redirect_uri must be one of the client's. The token endpoint must be https on a public address (MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES opens private ones), and redirects are not followed. Every call is audited, a failed one included.

Request fields:

Field	Required	Description
id	yes	Required: the shared client the sign-in started with (McpOAuthClient.id).
code	yes	Required: the authorization code the provider returned.
code_verifier	yes	Required: the PKCE code verifier of the sign-in.
redirect_uri	yes	Required: the redirect URI the sign-in used; one of the client's.

Response fields:

Field	Required	Description
access_token	no	The access token. Use it, do not store it.

{"signatures":{"go":"func (x *McpOAuthClientsClient) ExchangeDeploymentMcpOAuthCode(ctx context.Context, req *mcpv1.ExchangeDeploymentMcpOAuthCodeRequest) (*mcpv1.ExchangeDeploymentMcpOAuthCodeResponse, error)","python":"exchange_deployment_mcp_oauth_code(req: mcp_oauth_clients_pb2.ExchangeDeploymentMcpOAuthCodeRequest) -\u003e ExchangeDeploymentMcpOAuthCodeResponse","typescript":"exchangeDeploymentMcpOAuthCode(req: MessageInitShape\u003ctypeof tars_mcp_v1_mcp_oauth_clients_pb.ExchangeDeploymentMcpOAuthCodeRequestSchema\u003e): Promise\u003cExchangeDeploymentMcpOAuthCodeResponse\u003e","curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients/01H...:exchangeCode\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"code\": \"...\",\n    \"code_verifier\": \"...\",\n    \"redirect_uri\": \"...\"\n  }'"},"examples":{"go":{"files":[{"name":"main.go","content":"// Command example is a runnable example for the AgentRouter Go SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then `go run .`.\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\n\tagentrouter \"github.com/tetrateio/agentrouter-go\"\n\tmcpv1 \"github.com/tetrateio/agentrouter-go/genapi/api/tars/mcp/v1\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\n\tclient, err := agentrouter.New(ctx,\n\t\tagentrouter.WithBaseURL(os.Getenv(\"AGENTROUTER_BASE_URL\")),\n\t\tagentrouter.WithAPIKey(os.Getenv(\"AGENTROUTER_API_KEY\")),\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"client: %v\", err)\n\t}\n\n\t// Populate the request fields -- see the \"Request fields\" table above for\n\t// the available fields and which are required.\n\treq := \u0026mcpv1.ExchangeDeploymentMcpOAuthCodeRequest{}\n\n\tresp, err := client.McpOAuthClients().ExchangeDeploymentMcpOAuthCode(ctx, req)\n\tif err != nil {\n\t\tlog.Fatalf(\"call: %v\", err)\n\t}\n\n\tfmt.Printf(\"%+v\\n\", resp)\n}\n"},{"name":"go.mod","content":"module github.com/tetrateio/agentrouter-go-examples/mcpoauthclients/exchangedeploymentmcpoauthcode\n\ngo 1.26\n\nrequire github.com/tetrateio/agentrouter-go v0.1.1\n\n// Point this at the directory you extracted the downloaded Go SDK tarball into.\n// The directory name matches the tarball stem on the Download SDK page.\nreplace github.com/tetrateio/agentrouter-go =\u003e ./third_party/agentrouter-go-0.1.1\n"}]},"python":{"files":[{"name":"main.py","content":"\"\"\"Runnable example for the AgentRouter Python SDK.\n\nSet AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `python main.py`.\n\"\"\"\nimport os\n\nfrom tars.mcp.v1 import mcp_oauth_clients_pb2\n\nfrom agentrouter_sdk import Client\n\nclient = Client(\n    base_url=os.environ[\"AGENTROUTER_BASE_URL\"],\n    api_key=os.environ[\"AGENTROUTER_API_KEY\"],\n)\n\n# Populate the request fields -- see the \"Request fields\" table above\n# for the available fields and which are required.\nreq = mcp_oauth_clients_pb2.ExchangeDeploymentMcpOAuthCodeRequest()\ntry:\n    result = client.mcp_oauth_clients.exchange_deployment_mcp_oauth_code(req)\n    print(result)\nexcept Exception as err:\n    print(\"Error:\", err)\n"},{"name":"requirements.txt","content":"# Point this at the directory you extracted the downloaded Python SDK tarball\n# into. The directory name matches the tarball stem on the Download SDK page.\n# To install instead from PyPI once published, replace the line below with:\n#   agentrouter-sdk\u003e=0.1.0\nagentrouter-sdk @ file:./third_party/agentrouter-python-0.1.1\n"}]},"typescript":{"files":[{"name":"index.ts","content":"// Runnable example for the AgentRouter TypeScript SDK.\n// Set AGENTROUTER_BASE_URL and AGENTROUTER_API_KEY in the environment, then run `npm install \u0026\u0026 npx tsx index.ts`.\nimport { Client } from '@tetrate/agentrouter-sdk'\n\nconst client = new Client({\n  baseUrl: process.env.AGENTROUTER_BASE_URL,\n  apiKey: process.env.AGENTROUTER_API_KEY,\n})\n\n// Populate the request fields -- see the \"Request fields\" table above\n// for the available fields and which are required.\nconst req = {}\ntry {\n  const result = await client.mcpOauthClients.exchangeDeploymentMcpOAuthCode(req)\n  console.log(result)\n} catch (err) {\n  console.error('Error:', err)\n}\n"},{"name":"package.json","content":"{\n  \"name\": \"mcpoauthclients\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@tetrate/agentrouter-sdk\": \"file:./third_party/agentrouter-typescript-0.1.1\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^20.0.0\",\n    \"typescript\": \"^5.4.0\"\n  }\n}\n"},{"name":"tsconfig.json","content":"{\n  \"compilerOptions\": {\n    \"target\": \"ES2020\",\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"strict\": true,\n    \"esModuleInterop\": true,\n    \"skipLibCheck\": true\n  }\n}\n"}]},"curl":"curl -X POST \"${AGENTROUTER_BASE_URL}/v1/mcp-oauth-clients/01H...:exchangeCode\" \\\n  -H \"Authorization: Bearer ak-${AGENTROUTER_API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"code\": \"...\",\n    \"code_verifier\": \"...\",\n    \"redirect_uri\": \"...\"\n  }'"},"persona":"Admin","httpVerb":"POST","httpPath":"/v1/mcp-oauth-clients/{id}:exchangeCode","slug":"exchange-an-oauth-code-through-a-shared-mcp-oauth-client"}

---