# clerk_oauth_application (Resource)

An OAuth application: the instance acts as an OAuth identity provider for another application.

## Example Usage

```terraform
resource "clerk_oauth_application" "partner_portal" {
  name         = "Partner portal"
  callback_url = "https://portal.example.com/oauth/callback"
  scopes       = "profile email"
}

output "partner_portal_client_secret" {
  value     = clerk_oauth_application.partner_portal.client_secret
  sensitive = true
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `callback_url` (String) Redirect URI of the application.
- `name` (String) Application name, shown on the consent screen.

### Optional

- `consent_screen_enabled` (Boolean) Show the consent screen in the authorization flow.
- `public` (Boolean) `true` for a public client (PKCE, no secret). Create-only: a change forces a replacement.
- `scopes` (String) Space-separated scopes, for example `"profile email"`. Clerk normalizes the value server-side (order, plus a forced `offline_access`); the provider keeps the configured value in state and cannot detect server-side drift on this field.

### Read-Only

- `authorize_url` (String) Authorization endpoint.
- `client_id` (String) OAuth client id.
- `client_secret` (String, Sensitive) OAuth client secret. Clerk returns it once, on create; the provider keeps that value in state. Null for a public client. Replace the resource to rotate it.
- `discovery_url` (String) OIDC discovery endpoint.
- `id` (String) OAuth application id.
- `token_fetch_url` (String) Token endpoint.
- `user_info_url` (String) User info endpoint.

## Import

Import is supported using the following syntax:

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
# The client secret is not importable; Clerk returns it only on create.
terraform import clerk_oauth_application.partner_portal oauth_app_2abcDEFghiJKLmnoPQRstuVWXyz
```