> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/cli/commands/mcp-oauth-providers.md).

# mcp-oauth-providers

OAuth provider registrations for MCP servers — the credential-issuer records that let external MCP clients authenticate to a Celigo MCP server.

**REST API**: [MCP OAuth Providers](https://developer.celigo.com/api/api-reference/mcp-oauth-providers)

```
celigo mcp-oauth-providers <subcommand> [args] [flags]
```

Supports all [global flags](/cli/getting-started/global-flags.md).

***

## Subcommands

| Subcommand             | Purpose                                                       |
| ---------------------- | ------------------------------------------------------------- |
| `list`                 | List all MCP OAuth providers.                                 |
| `get <id>`             | Fetch one MCP OAuth provider by ID.                           |
| `create`               | Create an MCP OAuth provider from JSON (stdin or `--file`).   |
| `update <id>`          | Full-replace PUT from JSON (stdin or `--file`).               |
| `set <id> key=value …` | Refused on this group — credentials are masked. Use `update`. |
| `delete <id>`          | Delete an MCP OAuth provider by ID.                           |

***

## `celigo mcp-oauth-providers list`

List all MCP OAuth providers on the account.

In celigo-cli 2026.8.1 through 2026.8.8 the default `list` failed with `422 Unprocessable Entity` because the endpoint rejects the `include` projection, and only `--fields all` worked; since 2026.9.1 the default form works again (rows are trimmed client-side to the same columns).

**Signature**

```bash
celigo mcp-oauth-providers list
```

**Arguments**

None.

**Flags**

| Flag              | Type    | Default   | Description                                                                                                                                                                                                                         |
| ----------------- | ------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--fields <spec>` | string  | `default` | Fields to request per row. `default` returns `_id`, `name`, and the table columns; `all` returns complete documents; a comma-separated list requests specific fields. See [field projection](/cli/getting-started/global-flags.md). |
| `--limit <n>`     | integer | —         | Return at most `<n>` rows, fetching a single page.                                                                                                                                                                                  |

**Example**

```bash
celigo mcp-oauth-providers list --format table
celigo mcp-oauth-providers list --fields all
```

**Corresponds to**: `GET /v1/mcpoauthproviders` (operationId: `listMcpOauthProviders`)

***

## `celigo mcp-oauth-providers get`

Fetch one MCP OAuth provider by ID.

**Signature**

```bash
celigo mcp-oauth-providers get <id>
```

**Arguments**

| Argument | Type   | Required | Description            |
| -------- | ------ | -------- | ---------------------- |
| `<id>`   | string | Yes      | MCP OAuth provider ID. |

**Example**

```bash
celigo mcp-oauth-providers get 5f83a9b2c7d3e8f1a2b3c4d5
```

**Corresponds to**: `GET /v1/mcpoauthproviders/{_id}` (operationId: `getMcpOauthProviderById`)

***

## `celigo mcp-oauth-providers create`

Create an MCP OAuth provider from a JSON body. Reads from stdin by default, or from a file with `--file`.

**Signature**

```bash
celigo mcp-oauth-providers create [flags]
```

**Flags**

| Flag                | Type   | Default | Description                                                             |
| ------------------- | ------ | ------- | ----------------------------------------------------------------------- |
| `-f, --file <path>` | string | stdin   | Read the JSON body from a file instead of stdin (`-` also means stdin). |

**Request body**

Reads JSON. See the `POST /v1/mcpoauthproviders` schema for the full payload shape.

**Example**

```bash
cat provider.json | celigo mcp-oauth-providers create
celigo mcp-oauth-providers create --file provider.json
```

**Corresponds to**: `POST /v1/mcpoauthproviders` (operationId: `createMcpOauthProvider`)

***

## `celigo mcp-oauth-providers update`

Full replace of an MCP OAuth provider from a JSON body. Omitted fields are erased. Reads from stdin by default, or from a file with `--file`.

> ⚠️ **`update` replaces the entire provider.** Any field you omit is erased. `GET` the current record first, modify it, then `PUT` the complete object back.

`GET` masks the provider's encrypted fields as `******`. If you edit that response and submit it unchanged, `update` refuses the payload, names each masked path it found, and exits without calling the API — submitting the placeholders would overwrite the real credentials. Replace each masked value with the actual secret, use `""` to clear it, or pass `--force` to submit the payload as written.

**Signature**

```bash
celigo mcp-oauth-providers update <id> [flags]
```

**Arguments**

| Argument | Type   | Required | Description            |
| -------- | ------ | -------- | ---------------------- |
| `<id>`   | string | Yes      | MCP OAuth provider ID. |

**Flags**

| Flag                | Type    | Default | Description                                                                            |
| ------------------- | ------- | ------- | -------------------------------------------------------------------------------------- |
| `-f, --file <path>` | string  | stdin   | Read the JSON body from a file instead of stdin (`-` also means stdin).                |
| `--force`           | boolean | `false` | Submit even if the body contains masked credential values (`***`) copied from a `GET`. |

**Request body**

Reads JSON. See the `PUT /v1/mcpoauthproviders/{_id}` schema for the full payload shape.

**Example**

```bash
celigo mcp-oauth-providers get 5f83a9b2c7d3e8f1a2b3c4d5 --format json > provider.json
# edit provider.json, replacing every ****** with the real value
cat provider.json | celigo mcp-oauth-providers update 5f83a9b2c7d3e8f1a2b3c4d5
```

**Corresponds to**: `PUT /v1/mcpoauthproviders/{_id}` (operationId: `updateMcpOauthProvider`)

***

## `celigo mcp-oauth-providers set`

> ⚠️ **`set` refuses every field on this group, by design.** The API masks `clientSecret` as `******` on read, so the `GET` → modify → `PUT` that `set` would use overwrites the stored secret with the mask. Rather than destroy the credential, `set` fails with a message naming the field and directing you to `update`. Use `update` with the real credential values.

**Signature**

```bash
celigo mcp-oauth-providers set <id> [assignments...]
```

**Arguments**

| Argument           | Type              | Required | Description                                                                         |
| ------------------ | ----------------- | -------- | ----------------------------------------------------------------------------------- |
| `<id>`             | string            | Yes      | MCP OAuth provider ID.                                                              |
| `[assignments...]` | `key=value` pairs | Yes      | One or more field assignments. Every assignment is refused — see the callout above. |

**Behavior**

`set` chooses one of three strategies per resource group. On groups with a `PATCH` whitelist, whitelisted fields apply atomically. On other groups it round-trips `GET` → modify → `PUT`. MCP OAuth providers are a credential-masked group with no whitelist, so neither path is safe and the command errors instead:

```
Cannot set name on a mcp-oauth-provider via 'set': its credentials are masked,
so a GET+PUT would overwrite them with "******".
No field can be set on a mcp-oauth-provider. Use 'mcp-oauth-providers update'
with the real credential values instead.
```

Connections and iClients carry the same guard, but both have a `PATCH` whitelist, so a whitelisted field still succeeds there.

**Example**

```bash
# Fails — set is unavailable on this group
celigo mcp-oauth-providers set 5f83a9b2c7d3e8f1a2b3c4d5 name="Okta provider"

# Rename via update instead
celigo mcp-oauth-providers update 5f83a9b2c7d3e8f1a2b3c4d5 --file provider.json
```

***

## `celigo mcp-oauth-providers delete`

Delete an MCP OAuth provider by ID.

> ⚠️ **Deleting an OAuth provider cannot be undone.** Any MCP server that references this provider for client authentication will stop authenticating those clients.

**Signature**

```bash
celigo mcp-oauth-providers delete <id> [flags]
```

**Arguments**

| Argument | Type   | Required | Description            |
| -------- | ------ | -------- | ---------------------- |
| `<id>`   | string | Yes      | MCP OAuth provider ID. |

**Flags**

| Flag        | Type    | Default | Description        |
| ----------- | ------- | ------- | ------------------ |
| `-y, --yes` | boolean | `false` | Skip confirmation. |

**Example**

```bash
celigo mcp-oauth-providers delete 5f83a9b2c7d3e8f1a2b3c4d5 -y
```

**Corresponds to**: `DELETE /v1/mcpoauthproviders/{_id}` (operationId: `deleteMcpOauthProvider`)

***

## Related

* [mcp-servers](/cli/commands/mcp-servers.md) — MCP server resources that reference an OAuth provider for client authentication.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developer.celigo.com/cli/commands/mcp-oauth-providers.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.