> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/cli/commands/mcp-oauth-providers.md).

# mcp-oauth-providers

OAuth provider registrations for MCP servers — the credential-issuer records that let external MCP clients authenticate to a Celigo MCP server.

**REST API**: [MCP OAuth Providers](https://developer.celigo.com/api/api-reference/ai-and-mcp/mcp-oauth-providers)

```
celigo mcp-oauth-providers <subcommand> [args] [flags]
```

Supports all [global flags](/cli/getting-started/global-flags.md).

***

## Subcommands

| Subcommand             | Purpose                                                       |
| ---------------------- | ------------------------------------------------------------- |
| `list`                 | List all MCP OAuth providers.                                 |
| `get <id>`             | Fetch one MCP OAuth provider by ID.                           |
| `create`               | Create an MCP OAuth provider from JSON (stdin or `--file`).   |
| `update <id>`          | Full-replace PUT from JSON (stdin or `--file`).               |
| `set <id> key=value …` | Refused on this group — credentials are masked. Use `update`. |
| `delete <id>`          | Delete an MCP OAuth provider by ID.                           |

***

## `celigo mcp-oauth-providers list`

List all MCP OAuth providers on the account.

In celigo-cli 2026.8.1 through 2026.8.8 the default `list` failed with `422 Unprocessable Entity` because the endpoint rejects the `include` projection, and only `--fields all` worked; since 2026.9.1 the default form works again (rows are trimmed client-side to the same columns).

**Signature**

```bash
celigo mcp-oauth-providers list
```

**Arguments**

None.

**Flags**

| Flag              | Type    | Default   | Description                                                                                                                                                                                                                         |
| ----------------- | ------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--fields <spec>` | string  | `default` | Fields to request per row. `default` returns `_id`, `name`, and the table columns; `all` returns complete documents; a comma-separated list requests specific fields. See [field projection](/cli/getting-started/global-flags.md). |
| `--limit <n>`     | integer | —         | Return at most `<n>` rows, fetching a single page.                                                                                                                                                                                  |

**Example**

```bash
celigo mcp-oauth-providers list --format table
celigo mcp-oauth-providers list --fields all
```

**Corresponds to**: `GET /v1/mcpoauthproviders` (operationId: `listMcpOauthProviders`)

***

## `celigo mcp-oauth-providers get`

Fetch one MCP OAuth provider by ID.

**Signature**

```bash
celigo mcp-oauth-providers get <id>
```

**Arguments**

| Argument | Type   | Required | Description            |
| -------- | ------ | -------- | ---------------------- |
| `<id>`   | string | Yes      | MCP OAuth provider ID. |

**Example**

```bash
celigo mcp-oauth-providers get 5f83a9b2c7d3e8f1a2b3c4d5
```

**Corresponds to**: `GET /v1/mcpoauthproviders/{_id}` (operationId: `getMcpOauthProviderById`)

***

## `celigo mcp-oauth-providers create`

Create an MCP OAuth provider from a JSON body. Reads from stdin by default, or from a file with `--file`.

**Signature**

```bash
celigo mcp-oauth-providers create [flags]
```

**Flags**

| Flag                | Type   | Default | Description                                                             |
| ------------------- | ------ | ------- | ----------------------------------------------------------------------- |
| `-f, --file <path>` | string | stdin   | Read the JSON body from a file instead of stdin (`-` also means stdin). |

**Request body**

Reads JSON. See the `POST /v1/mcpoauthproviders` schema for the full payload shape.

**Example**

```bash
cat provider.json | celigo mcp-oauth-providers create
celigo mcp-oauth-providers create --file provider.json
```

**Corresponds to**: `POST /v1/mcpoauthproviders` (operationId: `createMcpOauthProvider`)

***

## `celigo mcp-oauth-providers update`

Full replace of an MCP OAuth provider from a JSON body. Omitted fields are erased. Reads from stdin by default, or from a file with `--file`.

> ⚠️ **`update` replaces the entire provider.** Any field you omit is erased. `GET` the current record first, modify it, then `PUT` the complete object back.

`GET` masks the provider's encrypted fields as `******`. If you edit that response and submit it unchanged, `update` refuses the payload, names each masked path it found, and exits without calling the API — submitting the placeholders would overwrite the real credentials. Replace each masked value with the actual secret, use `""` to clear it, or pass `--force` to submit the payload as written.

**Signature**

```bash
celigo mcp-oauth-providers update <id> [flags]
```

**Arguments**

| Argument | Type   | Required | Description            |
| -------- | ------ | -------- | ---------------------- |
| `<id>`   | string | Yes      | MCP OAuth provider ID. |

**Flags**

| Flag                | Type    | Default | Description                                                                            |
| ------------------- | ------- | ------- | -------------------------------------------------------------------------------------- |
| `-f, --file <path>` | string  | stdin   | Read the JSON body from a file instead of stdin (`-` also means stdin).                |
| `--force`           | boolean | `false` | Submit even if the body contains masked credential values (`***`) copied from a `GET`. |

**Request body**

Reads JSON. See the `PUT /v1/mcpoauthproviders/{_id}` schema for the full payload shape.

**Example**

```bash
celigo mcp-oauth-providers get 5f83a9b2c7d3e8f1a2b3c4d5 --format json > provider.json
# edit provider.json, replacing every ****** with the real value
cat provider.json | celigo mcp-oauth-providers update 5f83a9b2c7d3e8f1a2b3c4d5
```

**Corresponds to**: `PUT /v1/mcpoauthproviders/{_id}` (operationId: `updateMcpOauthProvider`)

***

## `celigo mcp-oauth-providers set`

> ⚠️ **`set` refuses every field on this group, by design.** The API masks `clientSecret` as `******` on read, so the `GET` → modify → `PUT` that `set` would use overwrites the stored secret with the mask. Rather than destroy the credential, `set` fails with a message naming the field and directing you to `update`. Use `update` with the real credential values.

**Signature**

```bash
celigo mcp-oauth-providers set <id> [assignments...]
```

**Arguments**

| Argument           | Type              | Required | Description                                                                         |
| ------------------ | ----------------- | -------- | ----------------------------------------------------------------------------------- |
| `<id>`             | string            | Yes      | MCP OAuth provider ID.                                                              |
| `[assignments...]` | `key=value` pairs | Yes      | One or more field assignments. Every assignment is refused — see the callout above. |

**Behavior**

`set` chooses one of three strategies per resource group. On groups with a `PATCH` whitelist, whitelisted fields apply atomically. On other groups it round-trips `GET` → modify → `PUT`. MCP OAuth providers are a credential-masked group with no whitelist, so neither path is safe and the command errors instead:

```
Cannot set name on a mcp-oauth-provider via 'set': its credentials are masked,
so a GET+PUT would overwrite them with "******".
No field can be set on a mcp-oauth-provider. Use 'mcp-oauth-providers update'
with the real credential values instead.
```

Connections and iClients carry the same guard, but both have a `PATCH` whitelist, so a whitelisted field still succeeds there.

**Example**

```bash
# Fails — set is unavailable on this group
celigo mcp-oauth-providers set 5f83a9b2c7d3e8f1a2b3c4d5 name="Okta provider"

# Rename via update instead
celigo mcp-oauth-providers update 5f83a9b2c7d3e8f1a2b3c4d5 --file provider.json
```

***

## `celigo mcp-oauth-providers delete`

Delete an MCP OAuth provider by ID.

> ⚠️ **Deleting an OAuth provider cannot be undone.** Any MCP server that references this provider for client authentication will stop authenticating those clients.

**Signature**

```bash
celigo mcp-oauth-providers delete <id> [flags]
```

**Arguments**

| Argument | Type   | Required | Description            |
| -------- | ------ | -------- | ---------------------- |
| `<id>`   | string | Yes      | MCP OAuth provider ID. |

**Flags**

| Flag        | Type    | Default | Description        |
| ----------- | ------- | ------- | ------------------ |
| `-y, --yes` | boolean | `false` | Skip confirmation. |

**Example**

```bash
celigo mcp-oauth-providers delete 5f83a9b2c7d3e8f1a2b3c4d5 -y
```

**Corresponds to**: `DELETE /v1/mcpoauthproviders/{_id}` (operationId: `deleteMcpOauthProvider`)

***

## Related

* [mcp-servers](/cli/commands/mcp-servers.md) — MCP server resources that reference an OAuth provider for client authentication.