mcp-oauth-providers

OAuth provider registrations for MCP servers — the credential-issuer records that let external MCP clients authenticate to a Celigo MCP server.

REST API: MCP OAuth Providers

celigo mcp-oauth-providers <subcommand> [args] [flags]

Supports all global flags.

---

Subcommands

Subcommand	Purpose
list	List all MCP OAuth providers.
get <id>	Fetch one MCP OAuth provider by ID.
create	Create an MCP OAuth provider from JSON (stdin or --file).
update <id>	Full-replace PUT from JSON (stdin or --file).
set <id> key=value …	Refused on this group — credentials are masked. Use update.
delete <id>	Delete an MCP OAuth provider by ID.

---

celigo mcp-oauth-providers list

List all MCP OAuth providers on the account.

Signature

celigo mcp-oauth-providers list

Arguments

None.

Flags

Flag	Type	Default	Description
--fields <spec>	string	default	Fields to request per row. default returns _id, name, and the table columns; all returns complete documents; a comma-separated list requests specific fields. See field projection.
--limit <n>	integer	—	Return at most <n> rows, fetching a single page.

Example

celigo mcp-oauth-providers list --format table
celigo mcp-oauth-providers list --fields all

Corresponds to: GET /v1/mcpoauthproviders (operationId: listMcpOauthProviders)

---

celigo mcp-oauth-providers get

Fetch one MCP OAuth provider by ID.

Signature

celigo mcp-oauth-providers get <id>

Arguments

Argument	Type	Required	Description
<id>	string	Yes	MCP OAuth provider ID.

Example

celigo mcp-oauth-providers get 5f83a9b2c7d3e8f1a2b3c4d5

Corresponds to: GET /v1/mcpoauthproviders/{_id} (operationId: getMcpOauthProviderById)

---

celigo mcp-oauth-providers create

Create an MCP OAuth provider from a JSON body. Reads from stdin by default, or from a file with --file.

Signature

celigo mcp-oauth-providers create [flags]

Flags

Flag	Type	Default	Description
-f, --file <path>	string	stdin	Read the JSON body from a file instead of stdin (- also means stdin).

Request body

Reads JSON. See the POST /v1/mcpoauthproviders schema for the full payload shape.

Example

cat provider.json | celigo mcp-oauth-providers create
celigo mcp-oauth-providers create --file provider.json

Corresponds to: POST /v1/mcpoauthproviders (operationId: createMcpOauthProvider)

---

celigo mcp-oauth-providers update

Full replace of an MCP OAuth provider from a JSON body. Omitted fields are erased. Reads from stdin by default, or from a file with --file.

⚠️ update replaces the entire provider. Any field you omit is erased. GET the current record first, modify it, then PUT the complete object back.

GET masks the provider's encrypted fields as ******. If you edit that response and submit it unchanged, update refuses the payload, names each masked path it found, and exits without calling the API — submitting the placeholders would overwrite the real credentials. Replace each masked value with the actual secret, use "" to clear it, or pass --force to submit the payload as written.

Signature

celigo mcp-oauth-providers update <id> [flags]

Arguments

Argument	Type	Required	Description
<id>	string	Yes	MCP OAuth provider ID.

Flags

Flag	Type	Default	Description
-f, --file <path>	string	stdin	Read the JSON body from a file instead of stdin (- also means stdin).
--force	boolean	false	Submit even if the body contains masked credential values (***) copied from a GET.

Request body

Reads JSON. See the PUT /v1/mcpoauthproviders/{_id} schema for the full payload shape.

Example

celigo mcp-oauth-providers get 5f83a9b2c7d3e8f1a2b3c4d5 --format json > provider.json
# edit provider.json, replacing every ****** with the real value
cat provider.json | celigo mcp-oauth-providers update 5f83a9b2c7d3e8f1a2b3c4d5

Corresponds to: PUT /v1/mcpoauthproviders/{_id} (operationId: updateMcpOauthProvider)

---

celigo mcp-oauth-providers set

⚠️ set refuses every field on this group, by design. The API masks clientSecret as ****** on read, so the GET → modify → PUT that set would use overwrites the stored secret with the mask. Rather than destroy the credential, set fails with a message naming the field and directing you to update. Use update with the real credential values.

Signature

celigo mcp-oauth-providers set <id> [assignments...]

Arguments

Argument	Type	Required	Description
<id>	string	Yes	MCP OAuth provider ID.
[assignments...]	key=value pairs	Yes	One or more field assignments. Every assignment is refused — see the callout above.

Behavior

set chooses one of three strategies per resource group. On groups with a PATCH whitelist, whitelisted fields apply atomically. On other groups it round-trips GET → modify → PUT. MCP OAuth providers are a credential-masked group with no whitelist, so neither path is safe and the command errors instead:

Cannot set name on a mcp-oauth-provider via 'set': its credentials are masked,
so a GET+PUT would overwrite them with "******".
No field can be set on a mcp-oauth-provider. Use 'mcp-oauth-providers update'
with the real credential values instead.

Connections and iClients carry the same guard, but both have a PATCH whitelist, so a whitelisted field still succeeds there.

Example

# Fails — set is unavailable on this group
celigo mcp-oauth-providers set 5f83a9b2c7d3e8f1a2b3c4d5 name="Okta provider"

# Rename via update instead
celigo mcp-oauth-providers update 5f83a9b2c7d3e8f1a2b3c4d5 --file provider.json

---

celigo mcp-oauth-providers delete

Delete an MCP OAuth provider by ID.

⚠️ Deleting an OAuth provider cannot be undone. Any MCP server that references this provider for client authentication will stop authenticating those clients.

Signature

celigo mcp-oauth-providers delete <id> [flags]

Arguments

Argument	Type	Required	Description
<id>	string	Yes	MCP OAuth provider ID.

Flags

Flag	Type	Default	Description
-y, --yes	boolean	false	Skip confirmation.

Example

celigo mcp-oauth-providers delete 5f83a9b2c7d3e8f1a2b3c4d5 -y

Corresponds to: DELETE /v1/mcpoauthproviders/{_id} (operationId: deleteMcpOauthProvider)

---

Related

• mcp-servers — MCP server resources that reference an OAuth provider for client authentication.