---
operationId: "updateNeonAuthOAuthProviderPlugin"
method: "PATCH"
path: "/projects/{project_id}/branches/{branch_id}/auth/plugins/oauth-provider"
tag: "auth"
stability: "beta"
interfaces: ["api", "sdk"]
---
> API Reference / Authentication / Update OAuth provider plugin configuration

## PATCH /projects/{project_id}/branches/{branch_id}/auth/plugins/oauth-provider

Updates the OAuth provider plugin configuration for Neon Auth.
Only the fields provided in the request body are updated; omitted fields retain their current values.
A provided `resources` list replaces the stored list.
A provided `mcp` object replaces the stored MCP configuration and must include `resource`.
The plugin can only be enabled on the project's root branch.


### Parameters

- `project_id` (string, path, required)
  The Neon project ID
- `branch_id` (string, path, required)
  The Neon branch ID

### Request body

- `enabled` (boolean, optional)
  Whether the OAuth provider plugin is enabled.
- `login_page` (string, optional)
  URL of the page that authorization requests redirect to for sign-in.
- `consent_page` (string, optional)
  URL of the page that authorization requests redirect to for consent.
- `mcp` (object, optional)
  MCP resource configuration. When provided, `resource` is required and the stored MCP configuration is replaced as a whole.
  - `resource` (string, required)
    The MCP server URL that MCP clients (Client ID Metadata Document and dynamically registered) are linked to. Required for either to be accepted.
  - `dynamic_registration` (boolean, optional)
    Whether MCP clients may register themselves via dynamic client registration (RFC 7591). When omitted, the stored value is kept.
  - `client_id_metadata_documents` (boolean, optional)
    Whether MCP clients may identify themselves with an https Client ID Metadata Document (CIMD) URL. When omitted, the stored value is kept.
- `resources` (array, optional)
  Protected resources that clients can be linked to. When provided, replaces the stored list.
  - `identifier` (string, required)
    Absolute URL identifying a protected resource. Issued access tokens carry it as their audience.

### Response (200)

- `enabled` (boolean, optional)
  Whether the OAuth provider plugin is enabled.
  Default: `false`
- `login_page` (string, optional)
  URL of the page that authorization requests redirect to for sign-in.
- `consent_page` (string, optional)
  URL of the page that authorization requests redirect to for consent.
- `mcp` (object, optional)
  MCP resource configuration.
  - `resource` (string, optional)
    The MCP server URL that MCP clients (Client ID Metadata Document and dynamically registered) are linked to. Required for either to be accepted.
  - `dynamic_registration` (boolean, optional)
    Legacy: whether MCP clients may register themselves via dynamic client registration (RFC 7591). Deprecated in favor of Client ID Metadata Documents (CIMD), which are controlled by `client_id_metadata_documents`. Defaults to false, and takes effect only when an MCP resource is configured; reads report false otherwise. When false, only CIMD clients and clients created through the OAuth clients API can be used, and they can still be linked to the MCP resource.
    Default: `false`
  - `client_id_metadata_documents` (boolean, optional)
    Whether MCP clients may identify themselves with an https Client ID Metadata Document (CIMD) URL. Recommended over dynamic registration. When false, new CIMD clients are rejected and existing CIMD clients fail closed.
    Default: `true`
- `resources` (array, optional)
  Protected resources that clients can be linked to.
  - `identifier` (string, required)
    Absolute URL identifying a protected resource. Issued access tokens carry it as their audience.

### Code examples

```bash
curl "https://console.neon.tech/api/v2/projects/$PROJECT_ID/branches/$BRANCH_ID/auth/plugins/oauth-provider" \
  -X PATCH \
  -H "Authorization: Bearer $NEON_API_KEY"
```

```typescript
import { createNeonClient, raw } from '@neon/sdk';

const neon = createNeonClient({ apiKey: process.env.NEON_API_KEY });
const { data } = await raw.updateNeonAuthOAuthProviderPlugin({
  client: neon.client,
  path: {
    project_id: process.env.PROJECT_ID,
    branch_id: process.env.BRANCH_ID
  }
});
```

### Errors

**default**
General Error.

The request may or may not be safe to retry, depending on the HTTP method, response status code,
and whether a response was received.

- If no response is returned from the API, a network error or timeout likely occurred.
- In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results.

The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**.
The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout.

Any request that returns a `503 Service Unavailable` response is always safe to retry.

Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress.

- `request_id` (string, optional)
  Unique identifier for the request, useful for debugging.
  You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically.
  
- `code` (string, required)
  Machine-readable code classifying the error type. See `message` for a human-readable explanation.
  Default: ``
- `message` (string, required)
  Error message