> ## Documentation Index > Fetch the complete documentation index at: https://docs.prelude.so/llms.txt > Use this file to discover all available pages before exploring further. # Create or update OAuth server config > Enable and configure your application as an OAuth 2.0 authorization server. The presence of the `registration.dcr` and `registration.cimd` objects enables Dynamic Client Registration (RFC 7591) and Client ID Metadata Documents respectively; omit one to leave that mechanism disabled. ## OpenAPI ````yaml put /v2/session/apps/{appID}/oauth openapi: 3.1.1 info: title: Prelude Session Management API version: 0.0.1 summary: The Prelude API for Session Management description: The Prelude API for Session Management. contact: email: support@prelude.so url: https://prelude.so servers: - url: https://api.prelude.dev description: Production server security: - Authorization: [] tags: - name: Mode description: Manage the mode (dev/prod) of your application. - name: Tokens description: Mint development tokens for your application. - name: Users description: Manage the users of your application. - name: Webhooks description: Manage the webhooks of your application. - name: Domains description: Manage the domains of your application. - name: Config - Scopes description: Manage the scope configuration of your application. - name: Config - Groups description: >- Manage the group configuration of your application. A group owns a set of scopes; users assigned to a group are granted the group's scopes. - name: Config - Claims description: Manage the claims mapping configuration of your application. - name: Config - Step-up description: Manage the step-up authentication configuration of your application. - name: Config - Migration description: Manage the user migration configuration of your application. - name: Config - Login OTP description: Manage the OTP login configuration of your application. - name: Config - Login OAuth description: Manage the OAuth login configuration of your application. - name: Config - Login SAML description: Manage the SAML 2.0 SSO connections of your application. - name: Config - Login Password description: Manage the password login configuration of your application. - name: Config - Passkey description: Manage the WebAuthn passkey configuration of your application. - name: Config - OAuth Server description: >- Configure your application as an OAuth 2.0 authorization server so MCP clients and other third-party apps can sign your users in. paths: /v2/session/apps/{appID}/oauth: parameters: - $ref: '#/components/parameters/appIDParam' put: tags: - Config - OAuth Server summary: Create or update OAuth server config description: | Enable and configure your application as an OAuth 2.0 authorization server. The presence of the `registration.dcr` and `registration.cimd` objects enables Dynamic Client Registration (RFC 7591) and Client ID Metadata Documents respectively; omit one to leave that mechanism disabled. operationId: upsertOAuthServerConfig requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PutOAuthServerConfigRequest' responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/OAuthServerConfigResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/InvalidOAuthServerConfigError' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AppNotFoundError' components: parameters: appIDParam: in: path name: appID required: true description: The id of the app the request refers to. schema: $ref: '#/components/schemas/AppID' schemas: PutOAuthServerConfigRequest: type: object properties: default_provider_url: type: string description: >- Origin of your login UI. The server redirects the browser to `/sign-in` from `/authorize` and to `/oauth/consent` after login. Must be an absolute `http(s)` URL. examples: - https://auth.example.com registration: $ref: '#/components/schemas/OAuthRegistrationConfig' required: - default_provider_url - registration OAuthServerConfigResponse: type: object properties: default_provider_url: type: string examples: - https://auth.example.com registration: $ref: '#/components/schemas/OAuthRegistrationConfig' updated_at: type: integer format: int64 description: Unix timestamp (seconds) of the last update. examples: - 1718000000 required: - default_provider_url - registration - updated_at InvalidOAuthServerConfigError: type: object properties: code: type: string enum: - invalid_oauth_server_config examples: - invalid_oauth_server_config status: type: string enum: - bad_request examples: - bad_request message: type: string examples: - default_provider_url must be an absolute http(s) URL with a host required: - code - status - message AppNotFoundError: type: object properties: code: type: string enum: - app_not_found examples: - app_not_found status: type: string enum: - not_found examples: - not_found message: type: string examples: - The application was not found. required: - code - status - message AppID: type: string description: An application's unique identifier. examples: - 54e9ujn - fvua38g OAuthRegistrationConfig: type: object description: How third-party clients come to exist, and the settings they share. properties: redirect_uri_allowlist: type: array description: >- URI patterns every registration mechanism validates client `redirect_uri`s against. Each entry is a literal URI or a prefix ending in a single `*`. items: type: string examples: - - https://claude.ai/api/mcp/auth_callback - http://localhost/* dcr: description: Dynamic Client Registration policy. Omit to disable DCR. oneOf: - $ref: '#/components/schemas/OAuthDCRConfig' - type: 'null' cimd: description: Client ID Metadata Document policy. Omit to disable CIMD. oneOf: - $ref: '#/components/schemas/OAuthCIMDConfig' - type: 'null' OAuthDCRConfig: type: object description: Dynamic Client Registration (RFC 7591) policy. Present enables DCR. properties: default_scopes: type: array description: >- Scopes seeded onto every DCR-registered client, on top of what it requests. items: type: string examples: - - mcp:read auto_registered_client_ttl_seconds: type: integer format: int64 description: >- Expiry, in seconds, for DCR-issued clients. Omit for no expiry; must be positive when set. examples: - 2592000 OAuthCIMDConfig: type: object description: Client ID Metadata Document (CIMD) policy. Present enables CIMD. properties: client_url_allowlist: type: array description: >- `https`-only patterns restricting which `client_id` URLs the server will fetch. Each entry is a literal URL or a prefix ending in a single `*`. items: type: string examples: - - https://claude.ai/* default_scopes: type: array description: Scopes seeded onto every CIMD client, on top of what it requests. items: type: string examples: - - mcp:read cache_ttl_seconds: type: integer format: int64 description: >- How long a fetched metadata document is reused across flows. Omit for the resolver default; must be positive when set. examples: - 86400 securitySchemes: Authorization: type: http scheme: bearer ````