List the OAuth clients registered for an integration auth
Returns this space's own custom (BYO-app) clients (space, oldest first) plus the ONE default it inherits — the org default (org), else the system client (system) — when that is not one of its own. Other org and system clients are not listed: a space either uses its own clients or inherits the org's choice. is_default marks the client new connections use (no per-connect picker). Secrets are never returned. Org-level clients are managed on /api/org-integrations.
/api/integrations/{packageId}/auths/{authKey}/clientsCookie session from Better Auth. Requires X-Org-Id header for org-scoped routes.
In: cookie
Path Parameters
Integration package id (e.g. @official/gmail).
^@[a-z0-9][a-z0-9-]*/[a-z0-9][a-z0-9-]*$Auth key as declared in the manifest's auths map.
^[a-z][a-z0-9_]*$Header Parameters
Organization ID. Required for cookie auth. Not needed for API key auth (org resolved from key).
uuidSpace ID. Required for space-scoped routes (agents, runs, schedules, and space-scoped module routes). Not needed for API key auth (space resolved from key).
curl -X GET "https://your-instance/api/integrations/string/auths/string/clients"{
"object": "list",
"hasMore": true,
"data": [
{
"client_ref": "string",
"source": "system",
"client_id": "string",
"is_default": true,
"auto_provisioned": true,
"has_client_secret": true,
"token_endpoint_auth_method": "client_secret_post",
"redirect_uri": "string"
}
]
}{
"type": "https://docs.appstrate.dev/errors/forbidden",
"title": "Forbidden",
"status": 403,
"detail": "Insufficient permissions",
"code": "forbidden",
"request_id": "req_abc123"
}{
"type": "https://docs.appstrate.dev/errors/not-found",
"title": "Not Found",
"status": 404,
"detail": "Resource not found",
"code": "not_found",
"request_id": "req_abc123"
}