Change an OAuth app

PATCH/oauth/apps/{appId}

Signed inBeta: may change

Its name, description, addresses, logo, redirect URIs or scopes. New redirect URIs apply at once. A write or store scope added after a review works for others only once it’s approved too.

SDK method: collector.updateMyOAuthApp()
Headers: X-Request-Id

Path parameters

appIdstring (uuid)required

Request body required · application/json

UpdateOAuthApp

namestring
2–60 characters
descriptionstring or null
at most 300 characters
homepageUrlstring
at most 500 characters
privacyUrlstring
at most 500 characters
termsUrlstring or null
at most 500 characters
redirectUrisarray of string
Exact matches: https, or http on 127.0.0.1, [::1] or localhost (whose port may differ in a request).
1–10 items
scopesarray of enum
Personal or store scopes from the API key catalogue; never admin scopes.
1–40 items
One ofcatalog:readcollection:readcollection:writewishlist:readwishlist:writescans:write
and 31 more
scans:readlabels:readlabels:writeinsights:readinsights:writeexports:readholds:readholds:writequestions:readquestions:writeaccount:readaccount:writereports:writestores:readstores:writeassistant:usewebhooks:readwebhooks:writestore:readstore:inventory:readstore:inventory:writestore:holds:readstore:holds:writestore:questions:readstore:questions:writestore:storefront:writestore:staff:readstore:staff:writestore:billing:readstore:webhooks:readstore:webhooks:write
logoPathstring or null
A logo uploaded to your folder of the avatars bucket (app-<id>.webp), or null to remove it.
at most 200 characters

Responses

200OKThe app as it is now.

OAuthAppResult

appOAuthApprequired

7Errors400 · 401 · 404 · 409 · 413 · 429 · 500

400
invalid_request invalid_json
invalid_request: The query or body doesn’t match the schema (see errors[]).
invalid_json: The body isn’t JSON.
401
unauthorized
unauthorized: Not signed in (no session or token, or an expired one).
404
not_found
not_found: Nothing at that address.
409
app_changed
app_changed: Changed by another request at the same moment: look again.
413
payload_too_large
payload_too_large: The body is over 1,048,576 bytes, this operation’s limit.
429
rate_limited temporarily_blocked
rate_limited: Over the caller’s limit: the per-minute burst or the per-day quota (RateLimit headers; wait Retry-After seconds).
temporarily_blocked: Too many refused requests in a row: blocked for a while (Retry-After says how long).
500
internal
internal: Something went wrong on our side (quote the requestId).

curl -X PATCH 'https://api.collection.id/v1/oauth/apps/5e7a9c1b-3d2f-4a6e-8b0c-1d3f5a7b9c2e' \
  -H "Authorization: Bearer $COLLECTOR_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "redirectUris": [
      "https://shelfie.example/callback",
      "https://shelfie.example/auth/return"
    ]
  }'

{
  "app": {
    "id": "5e7a9c1b-3d2f-4a6e-8b0c-1d3f5a7b9c2e",
    "clientId": "app_k3v9q2m7x1c8d4f6h0j5",
    "clientType": "confidential",
    "name": "Shelfie",
    "description": "Your collection on a shelf you can share.",
    "homepageUrl": "https://shelfie.example",
    "privacyUrl": "https://shelfie.example/privacy",
    "termsUrl": null,
    "logoPath": "6f2c0a4e-3b1d-4c8e-9a7f-2d5e8b1c4a90/app-3f2a9c.webp",
    "logoUrl": "https://example.supabase.co/storage/v1/object/public/avatars/6f2c0a4e-3b1d-4c8e-9a7f-2d5e8b1c4a90/app-3f2a9c.webp",
    "redirectUris": [
      "https://shelfie.example/callback",
      "https://shelfie.example/auth/return"
    ],
    "scopes": [
      "catalog:read",
      "collection:read",
      "collection:write"
    ],
    "secret": {
      "display": "ccs_live_Xq3b…",
      "createdAt": "2026-10-13T06:47:11.610Z",
      "previousExpiresAt": null
    },
    "review": {
      "status": "unreviewed",
      "approvedScopes": [],
      "awaitingScopes": [
        "collection:write"
      ],
      "note": null,
      "requestedAt": null,
      "reviewedAt": null
    },
    "suspendedAt": null,
    "suspendedReason": null,
    "connections": 0,
    "createdAt": "2026-10-13T06:47:11.610Z",
    "updatedAt": "2026-10-13T06:47:11.610Z"
  }
}

Request body required · application/json

UpdateOAuthApp

namestring
2–60 characters
descriptionstring or null
at most 300 characters
homepageUrlstring
at most 500 characters
privacyUrlstring
at most 500 characters
termsUrlstring or null
at most 500 characters
redirectUrisarray of string
Exact matches: https, or http on 127.0.0.1, [::1] or localhost (whose port may differ in a request).
1–10 items
scopesarray of enum
Personal or store scopes from the API key catalogue; never admin scopes.
1–40 items
One ofcatalog:readcollection:readcollection:writewishlist:readwishlist:writescans:write
and 31 more
scans:readlabels:readlabels:writeinsights:readinsights:writeexports:readholds:readholds:writequestions:readquestions:writeaccount:readaccount:writereports:writestores:readstores:writeassistant:usewebhooks:readwebhooks:writestore:readstore:inventory:readstore:inventory:writestore:holds:readstore:holds:writestore:questions:readstore:questions:writestore:storefront:writestore:staff:readstore:staff:writestore:billing:readstore:webhooks:readstore:webhooks:write
logoPathstring or null
A logo uploaded to your folder of the avatars bucket (app-<id>.webp), or null to remove it.
at most 200 characters

Responses

200OKThe app as it is now.

OAuthAppResult

appOAuthApprequired

7Errors400 · 401 · 404 · 409 · 413 · 429 · 500

400
invalid_request invalid_json
invalid_request: The query or body doesn’t match the schema (see errors[]).
invalid_json: The body isn’t JSON.
401
unauthorized
unauthorized: Not signed in (no session or token, or an expired one).
404
not_found
not_found: Nothing at that address.
409
app_changed
app_changed: Changed by another request at the same moment: look again.
413
payload_too_large
payload_too_large: The body is over 1,048,576 bytes, this operation’s limit.
429
rate_limited temporarily_blocked
rate_limited: Over the caller’s limit: the per-minute burst or the per-day quota (RateLimit headers; wait Retry-After seconds).
temporarily_blocked: Too many refused requests in a row: blocked for a while (Retry-After says how long).
500
internal
internal: Something went wrong on our side (quote the requestId).

curl -X PATCH 'https://api.collection.id/v1/oauth/apps/5e7a9c1b-3d2f-4a6e-8b0c-1d3f5a7b9c2e' \ -H "Authorization: Bearer $COLLECTOR_TOKEN" \ -H 'Content-Type: application/json' \ -d '{ "redirectUris": [ "https://shelfie.example/callback", "https://shelfie.example/auth/return" ] }'

{ "app": { "id": "5e7a9c1b-3d2f-4a6e-8b0c-1d3f5a7b9c2e", "clientId": "app_k3v9q2m7x1c8d4f6h0j5", "clientType": "confidential", "name": "Shelfie", "description": "Your collection on a shelf you can share.", "homepageUrl": "https://shelfie.example", "privacyUrl": "https://shelfie.example/privacy", "termsUrl": null, "logoPath": "6f2c0a4e-3b1d-4c8e-9a7f-2d5e8b1c4a90/app-3f2a9c.webp", "logoUrl": "https://example.supabase.co/storage/v1/object/public/avatars/6f2c0a4e-3b1d-4c8e-9a7f-2d5e8b1c4a90/app-3f2a9c.webp", "redirectUris": [ "https://shelfie.example/callback", "https://shelfie.example/auth/return" ], "scopes": [ "catalog:read", "collection:read", "collection:write" ], "secret": { "display": "ccs_live_Xq3b…", "createdAt": "2026-10-13T06:47:11.610Z", "previousExpiresAt": null }, "review": { "status": "unreviewed", "approvedScopes": [], "awaitingScopes": [ "collection:write" ], "note": null, "requestedAt": null, "reviewedAt": null }, "suspendedAt": null, "suspendedReason": null, "connections": 0, "createdAt": "2026-10-13T06:47:11.610Z", "updatedAt": "2026-10-13T06:47:11.610Z" } }