Skip to main content
PUT
Update client configuration

Authorizations

Authorization
string
header
required

RFC 7592 registration access token (returned once at registration) — used to read/update/delete the client's own configuration.

Path Parameters

clientId
string
required

Body

application/json

RFC 7591 client metadata. All fields optional except redirect_uris for authorization-code clients.

client_name
string
redirect_uris
string<uri>[]

Absolute HTTPS URIs; HTTP is allowed only for localhost, 127.0.0.1, or [::1], plus explicitly supported native callbacks. Userinfo, fragments, and wildcard bind addresses are rejected.

logo_uri
string<uri>
client_uri
string<uri>
contacts
string[]
grant_types
enum<string>[]
Available options:
authorization_code,
refresh_token,
client_credentials
response_types
enum<string>[]
Available options:
code
scope
string

Space-delimited capability scopes (whitelist-validated).

token_endpoint_auth_method
enum<string>
Available options:
none,
client_secret_basic,
client_secret_post
sandbox
boolean
default:false

Non-standard SideShift metadata. Register the client in test mode, so every token it is issued carries a sandbox claim and the routes that move money or reach outside SideShift refuse it with 403 sandbox_rejected. Reads and safe writes still work. Only the literal JSON true enables it - "true", 1 and other truthy values are treated as false, so a real client cannot be put into test mode by accident. Fixed at registration and not editable afterwards: register a second client to change modes.

Response

Updated client configuration.

RFC 7591/7592 client information response.

client_id
string
required
client_id_issued_at
integer
registration_access_token
string

Returned only on registration.

registration_client_uri
string<uri>
redirect_uris
string<uri>[]
grant_types
string[]
response_types
string[]
token_endpoint_auth_method
string
scope
string
client_name
string
logo_uri
string<uri>
client_uri
string<uri>
contacts
string[]
client_secret
string

Confidential clients only; returned once at registration.

client_secret_expires_at
integer