clerk_oauth_application (Resource)

An OAuth application: the instance acts as an OAuth identity provider for another application.

Example Usage

resource "clerk_oauth_application" "partner_portal" {
  name         = "Partner portal"
  callback_url = "https://portal.example.com/oauth/callback"
  scopes       = "profile email"
}

output "partner_portal_client_secret" {
  value     = clerk_oauth_application.partner_portal.client_secret
  sensitive = true
}

Schema

Required

• callback_url (String) Redirect URI of the application.
• name (String) Application name, shown on the consent screen.

Optional

• consent_screen_enabled (Boolean) Show the consent screen in the authorization flow.
• public (Boolean) true for a public client (PKCE, no secret). Create-only: a change forces a replacement.
• scopes (String) Space-separated scopes, for example "profile email". Clerk normalizes the value server-side (order, plus a forced offline_access); the provider keeps the configured value in state and cannot detect server-side drift on this field.

Read-Only

• authorize_url (String) Authorization endpoint.
• client_id (String) OAuth client id.
• client_secret (String, Sensitive) OAuth client secret. Clerk returns it once, on create; the provider keeps that value in state. Null for a public client. Replace the resource to rotate it.
• discovery_url (String) OIDC discovery endpoint.
• id (String) OAuth application id.
• token_fetch_url (String) Token endpoint.
• user_info_url (String) User info endpoint.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# The client secret is not importable; Clerk returns it only on create.
terraform import clerk_oauth_application.partner_portal oauth_app_2abcDEFghiJKLmnoPQRstuVWXyz