Update a client

Change a client's name, logo, redirect URIs, type or IP allowlist.

PATCH /organizations/{org}/clients/{clientId}

The body is the mask: the keys you send change, the rest stay as they are. Turning a public client confidential mints a secret and returns it as client_secret, once.

Authorization

Org owner. Anyone else gets 403 forbidden.

Path parameters

Name	Type	Description
`org`	string	The organization: its id (`org_…`) or its slug. It has to be an org your token can manage (see Who can call it)
`clientId`	string	The client, `cli_…`

Body

Field	Type	Required	Description
`name`	string	no	1–120 characters, trimmed
`logo`	string	no	An https URL
`redirect_uris`	string[]	no	Each https, or http on `localhost`, `127.0.0.1` or `[::1]`. Replaces the whole list
`confidential`	boolean	no	`true` on a public client mints a secret
`ip_allowlist`	string[]	no	IPs or CIDRs. Replaces the whole list

At least one field is required.

Response

200 OK with the updated client, plus client_secret if one was just minted.

{
  "id": "cli_65f1c2a9e4b0d3f7a1c8e902",
  "name": "Acme web",
  "logo": "https://…",
  "redirect_uris": ["https://app.acme.com/lgw/callback"],
  "confidential": false
}

Errors

Status	`error`	When
`400`	`invalid_request`	An empty body, an unknown field, or a value that fails validation
`403`	`forbidden`	You are not an owner of the org
`404`	`not_found`	No such client in this org, or the id is not a `cli_` id
`404`	`not_found`	The org does not exist, or your token cannot manage it

Example

curl -X PATCH https://loginwith.loginwith.dev/organizations/acme/clients/cli_65f1c2a9e4b0d3f7a1c8e902 \
  -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" \
  -d '{"redirect_uris": ["https://app.acme.com/lgw/callback", "http://localhost:5173/callback"]}'