Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Authentik Provider
  4. API Docs
  5. ProviderOauth2Dcr
Viewing docs for authentik 2026.8.0
published on Wednesday, Sep 9, 2026 by goauthentik
Schema (JSON)
goauthentik/terraform-provider-authentik

authentik.ProviderOauth2Dcr

Viewing docs for authentik 2026.8.0
published on Wednesday, Sep 9, 2026 by goauthentik
Schema (JSON)
goauthentik/terraform-provider-authentik

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as authentik from "@pulumi/authentik";

const default_authorization_flow = authentik.getFlow({
    slug: "default-provider-authorization-implicit-consent",
});
const default_provider_invalidation_flow = authentik.getFlow({
    slug: "default-provider-invalidation-flow",
});
const generated = authentik.getCertificateKeyPair({
    name: "authentik Self-signed Certificate",
    fetchKey: false,
    fetchCertificate: false,
});
const example = new authentik.ProviderOauth2("example", {
    name: "dcr-example",
    clientId: "dcr-example",
    signingKey: generated.then(generated => generated.id),
    authorizationFlow: default_authorization_flow.then(default_authorization_flow => default_authorization_flow.id),
    invalidationFlow: default_provider_invalidation_flow.then(default_provider_invalidation_flow => default_provider_invalidation_flow.id),
});
const exampleProviderOauth2Dcr = new authentik.ProviderOauth2Dcr("example", {
    oauth2Provider: example.providerOauth2Id,
    accessTokenValidity: "minutes=5",
    refreshTokenValidity: "days=30",
    allowedGrantTypes: [
        "authorization_code",
        "refresh_token",
    ],
});

    import pulumi
import pulumi_authentik as authentik

default_authorization_flow = authentik.get_flow(slug="default-provider-authorization-implicit-consent")
default_provider_invalidation_flow = authentik.get_flow(slug="default-provider-invalidation-flow")
generated = authentik.get_certificate_key_pair(name="authentik Self-signed Certificate",
    fetch_key=False,
    fetch_certificate=False)
example = authentik.ProviderOauth2("example",
    name="dcr-example",
    client_id="dcr-example",
    signing_key=generated.id,
    authorization_flow=default_authorization_flow.id,
    invalidation_flow=default_provider_invalidation_flow.id)
example_provider_oauth2_dcr = authentik.ProviderOauth2Dcr("example",
    oauth2_provider=example.provider_oauth2_id,
    access_token_validity="minutes=5",
    refresh_token_validity="days=30",
    allowed_grant_types=[
        "authorization_code",
        "refresh_token",
    ])

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/authentik/v2026/authentik"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		default_authorization_flow, err := authentik.LookupFlow(ctx, &authentik.LookupFlowArgs{
			Slug: pulumi.StringRef("default-provider-authorization-implicit-consent"),
		}, nil)
		if err != nil {
			return err
		}
		default_provider_invalidation_flow, err := authentik.LookupFlow(ctx, &authentik.LookupFlowArgs{
			Slug: pulumi.StringRef("default-provider-invalidation-flow"),
		}, nil)
		if err != nil {
			return err
		}
		generated, err := authentik.LookupCertificateKeyPair(ctx, &authentik.LookupCertificateKeyPairArgs{
			Name:             "authentik Self-signed Certificate",
			FetchKey:         pulumi.BoolRef(false),
			FetchCertificate: pulumi.BoolRef(false),
		}, nil)
		if err != nil {
			return err
		}
		example, err := authentik.NewProviderOauth2(ctx, "example", &authentik.ProviderOauth2Args{
			Name:              pulumi.String("dcr-example"),
			ClientId:          pulumi.String("dcr-example"),
			SigningKey:        pulumi.String(generated.Id),
			AuthorizationFlow: pulumi.String(default_authorization_flow.Id),
			InvalidationFlow:  pulumi.String(default_provider_invalidation_flow.Id),
		})
		if err != nil {
			return err
		}
		_, err = authentik.NewProviderOauth2Dcr(ctx, "example", &authentik.ProviderOauth2DcrArgs{
			Oauth2Provider:       example.ProviderOauth2Id,
			AccessTokenValidity:  pulumi.String("minutes=5"),
			RefreshTokenValidity: pulumi.String("days=30"),
			AllowedGrantTypes: pulumi.StringArray{
				pulumi.String("authorization_code"),
				pulumi.String("refresh_token"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Authentik = Pulumi.Authentik;

return await Deployment.RunAsync(() => 
{
    var default_authorization_flow = Authentik.GetFlow.Invoke(new()
    {
        Slug = "default-provider-authorization-implicit-consent",
    });

    var default_provider_invalidation_flow = Authentik.GetFlow.Invoke(new()
    {
        Slug = "default-provider-invalidation-flow",
    });

    var generated = Authentik.GetCertificateKeyPair.Invoke(new()
    {
        Name = "authentik Self-signed Certificate",
        FetchKey = false,
        FetchCertificate = false,
    });

    var example = new Authentik.ProviderOauth2("example", new()
    {
        Name = "dcr-example",
        ClientId = "dcr-example",
        SigningKey = generated.Apply(getCertificateKeyPairResult => getCertificateKeyPairResult.Id),
        AuthorizationFlow = default_authorization_flow.Apply(default_authorization_flow => default_authorization_flow.Apply(getFlowResult => getFlowResult.Id)),
        InvalidationFlow = default_provider_invalidation_flow.Apply(default_provider_invalidation_flow => default_provider_invalidation_flow.Apply(getFlowResult => getFlowResult.Id)),
    });

    var exampleProviderOauth2Dcr = new Authentik.ProviderOauth2Dcr("example", new()
    {
        Oauth2Provider = example.ProviderOauth2Id,
        AccessTokenValidity = "minutes=5",
        RefreshTokenValidity = "days=30",
        AllowedGrantTypes = new[]
        {
            "authorization_code",
            "refresh_token",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.authentik.AuthentikFunctions;
import com.pulumi.authentik.inputs.GetFlowArgs;
import com.pulumi.authentik.inputs.GetCertificateKeyPairArgs;
import com.pulumi.authentik.ProviderOauth2;
import com.pulumi.authentik.ProviderOauth2Args;
import com.pulumi.authentik.ProviderOauth2Dcr;
import com.pulumi.authentik.ProviderOauth2DcrArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var default-authorization-flow = AuthentikFunctions.getFlow(GetFlowArgs.builder()
            .slug("default-provider-authorization-implicit-consent")
            .build());

        final var default-provider-invalidation-flow = AuthentikFunctions.getFlow(GetFlowArgs.builder()
            .slug("default-provider-invalidation-flow")
            .build());

        final var generated = AuthentikFunctions.getCertificateKeyPair(GetCertificateKeyPairArgs.builder()
            .name("authentik Self-signed Certificate")
            .fetchKey(false)
            .fetchCertificate(false)
            .build());

        var example = new ProviderOauth2("example", ProviderOauth2Args.builder()
            .name("dcr-example")
            .clientId("dcr-example")
            .signingKey(generated.id())
            .authorizationFlow(default_authorization_flow.id())
            .invalidationFlow(default_provider_invalidation_flow.id())
            .build());

        var exampleProviderOauth2Dcr = new ProviderOauth2Dcr("exampleProviderOauth2Dcr", ProviderOauth2DcrArgs.builder()
            .oauth2Provider(example.providerOauth2Id())
            .accessTokenValidity("minutes=5")
            .refreshTokenValidity("days=30")
            .allowedGrantTypes(            
                "authorization_code",
                "refresh_token")
            .build());

    }
}

    resources:
  example:
    type: authentik:ProviderOauth2
    properties:
      name: dcr-example
      clientId: dcr-example
      signingKey: ${generated.id}
      authorizationFlow: ${["default-authorization-flow"].id}
      invalidationFlow: ${["default-provider-invalidation-flow"].id}
  exampleProviderOauth2Dcr:
    type: authentik:ProviderOauth2Dcr
    name: example
    properties:
      oauth2Provider: ${example.providerOauth2Id}
      accessTokenValidity: minutes=5
      refreshTokenValidity: days=30
      allowedGrantTypes:
        - authorization_code
        - refresh_token
variables:
  default-authorization-flow:
    fn::invoke:
      function: authentik:getFlow
      arguments:
        slug: default-provider-authorization-implicit-consent
  default-provider-invalidation-flow:
    fn::invoke:
      function: authentik:getFlow
      arguments:
        slug: default-provider-invalidation-flow
  generated:
    fn::invoke:
      function: authentik:getCertificateKeyPair
      arguments:
        name: authentik Self-signed Certificate
        fetchKey: false
        fetchCertificate: false

    Example coming soon!

    Create ProviderOauth2Dcr Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ProviderOauth2Dcr(name: string, args: ProviderOauth2DcrArgs, opts?: CustomResourceOptions);
    @overload
def ProviderOauth2Dcr(resource_name: str,
                      args: ProviderOauth2DcrArgs,
                      opts: Optional[ResourceOptions] = None)

@overload
def ProviderOauth2Dcr(resource_name: str,
                      opts: Optional[ResourceOptions] = None,
                      oauth2_provider: Optional[float] = None,
                      access_token_validity: Optional[str] = None,
                      allowed_grant_types: Optional[Sequence[str]] = None,
                      default_application_group: Optional[str] = None,
                      override_authorization_flow: Optional[str] = None,
                      override_invalidation_flow: Optional[str] = None,
                      override_property_mappings: Optional[Sequence[str]] = None,
                      policy_engine_mode: Optional[str] = None,
                      provider_oauth2_dcr_id: Optional[str] = None,
                      refresh_token_validity: Optional[str] = None)
    func NewProviderOauth2Dcr(ctx *Context, name string, args ProviderOauth2DcrArgs, opts ...ResourceOption) (*ProviderOauth2Dcr, error)
    public ProviderOauth2Dcr(string name, ProviderOauth2DcrArgs args, CustomResourceOptions? opts = null)
    public ProviderOauth2Dcr(String name, ProviderOauth2DcrArgs args)
public ProviderOauth2Dcr(String name, ProviderOauth2DcrArgs args, CustomResourceOptions options)

    type: authentik:ProviderOauth2Dcr
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "authentik_provider_oauth2_dcr" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args ProviderOauth2DcrArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ProviderOauth2DcrArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ProviderOauth2DcrArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ProviderOauth2DcrArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ProviderOauth2DcrArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var providerOauth2DcrResource = new Authentik.ProviderOauth2Dcr("providerOauth2DcrResource", new()
{
    Oauth2Provider = 0.0,
    AccessTokenValidity = "string",
    AllowedGrantTypes = new[]
    {
        "string",
    },
    DefaultApplicationGroup = "string",
    OverrideAuthorizationFlow = "string",
    OverrideInvalidationFlow = "string",
    OverridePropertyMappings = new[]
    {
        "string",
    },
    PolicyEngineMode = "string",
    ProviderOauth2DcrId = "string",
    RefreshTokenValidity = "string",
});

    example, err := authentik.NewProviderOauth2Dcr(ctx, "providerOauth2DcrResource", &authentik.ProviderOauth2DcrArgs{
	Oauth2Provider:      pulumi.Float64(0),
	AccessTokenValidity: pulumi.String("string"),
	AllowedGrantTypes: pulumi.StringArray{
		pulumi.String("string"),
	},
	DefaultApplicationGroup:   pulumi.String("string"),
	OverrideAuthorizationFlow: pulumi.String("string"),
	OverrideInvalidationFlow:  pulumi.String("string"),
	OverridePropertyMappings: pulumi.StringArray{
		pulumi.String("string"),
	},
	PolicyEngineMode:     pulumi.String("string"),
	ProviderOauth2DcrId:  pulumi.String("string"),
	RefreshTokenValidity: pulumi.String("string"),
})

    resource "authentik_provider_oauth2_dcr" "providerOauth2DcrResource" {
  lifecycle {
    create_before_destroy = true
  }
  oauth2_provider             = 0
  access_token_validity       = "string"
  allowed_grant_types         = ["string"]
  default_application_group   = "string"
  override_authorization_flow = "string"
  override_invalidation_flow  = "string"
  override_property_mappings  = ["string"]
  policy_engine_mode          = "string"
  provider_oauth2_dcr_id      = "string"
  refresh_token_validity      = "string"
}

    var providerOauth2DcrResource = new ProviderOauth2Dcr("providerOauth2DcrResource", ProviderOauth2DcrArgs.builder()
    .oauth2Provider(0.0)
    .accessTokenValidity("string")
    .allowedGrantTypes("string")
    .defaultApplicationGroup("string")
    .overrideAuthorizationFlow("string")
    .overrideInvalidationFlow("string")
    .overridePropertyMappings("string")
    .policyEngineMode("string")
    .providerOauth2DcrId("string")
    .refreshTokenValidity("string")
    .build());

    provider_oauth2_dcr_resource = authentik.ProviderOauth2Dcr("providerOauth2DcrResource",
    oauth2_provider=float(0),
    access_token_validity="string",
    allowed_grant_types=["string"],
    default_application_group="string",
    override_authorization_flow="string",
    override_invalidation_flow="string",
    override_property_mappings=["string"],
    policy_engine_mode="string",
    provider_oauth2_dcr_id="string",
    refresh_token_validity="string")

    const providerOauth2DcrResource = new authentik.ProviderOauth2Dcr("providerOauth2DcrResource", {
    oauth2Provider: 0,
    accessTokenValidity: "string",
    allowedGrantTypes: ["string"],
    defaultApplicationGroup: "string",
    overrideAuthorizationFlow: "string",
    overrideInvalidationFlow: "string",
    overridePropertyMappings: ["string"],
    policyEngineMode: "string",
    providerOauth2DcrId: "string",
    refreshTokenValidity: "string",
});

    type: authentik:ProviderOauth2Dcr
properties:
    accessTokenValidity: string
    allowedGrantTypes:
        - string
    defaultApplicationGroup: string
    oauth2Provider: 0
    overrideAuthorizationFlow: string
    overrideInvalidationFlow: string
    overridePropertyMappings:
        - string
    policyEngineMode: string
    providerOauth2DcrId: string
    refreshTokenValidity: string

    ProviderOauth2Dcr Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ProviderOauth2Dcr resource accepts the following input properties:

    Oauth2Provider double
    PK of the OAuth2 provider dynamic client registration applies to.
    AccessTokenValidity string
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    AllowedGrantTypes List<string>
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    DefaultApplicationGroup string
    Group to assign to automatically created applications.
    OverrideAuthorizationFlow string
    Authorization flow applied to dynamically registered clients.
    OverrideInvalidationFlow string
    OverridePropertyMappings List<string>
    PolicyEngineMode string
    Allowed values:

    • all
    • any Generated.
    ProviderOauth2DcrId string
    RefreshTokenValidity string
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    Oauth2Provider float64
    PK of the OAuth2 provider dynamic client registration applies to.
    AccessTokenValidity string
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    AllowedGrantTypes []string
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    DefaultApplicationGroup string
    Group to assign to automatically created applications.
    OverrideAuthorizationFlow string
    Authorization flow applied to dynamically registered clients.
    OverrideInvalidationFlow string
    OverridePropertyMappings []string
    PolicyEngineMode string
    Allowed values:

    • all
    • any Generated.
    ProviderOauth2DcrId string
    RefreshTokenValidity string
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    oauth2_provider number
    PK of the OAuth2 provider dynamic client registration applies to.
    access_token_validity string
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    allowed_grant_types list(string)
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    default_application_group string
    Group to assign to automatically created applications.
    override_authorization_flow string
    Authorization flow applied to dynamically registered clients.
    override_invalidation_flow string
    override_property_mappings list(string)
    policy_engine_mode string
    Allowed values:

    • all
    • any Generated.
    provider_oauth2_dcr_id string
    refresh_token_validity string
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    oauth2Provider Double
    PK of the OAuth2 provider dynamic client registration applies to.
    accessTokenValidity String
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    allowedGrantTypes List<String>
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    defaultApplicationGroup String
    Group to assign to automatically created applications.
    overrideAuthorizationFlow String
    Authorization flow applied to dynamically registered clients.
    overrideInvalidationFlow String
    overridePropertyMappings List<String>
    policyEngineMode String
    Allowed values:

    • all
    • any Generated.
    providerOauth2DcrId String
    refreshTokenValidity String
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    oauth2Provider number
    PK of the OAuth2 provider dynamic client registration applies to.
    accessTokenValidity string
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    allowedGrantTypes string[]
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    defaultApplicationGroup string
    Group to assign to automatically created applications.
    overrideAuthorizationFlow string
    Authorization flow applied to dynamically registered clients.
    overrideInvalidationFlow string
    overridePropertyMappings string[]
    policyEngineMode string
    Allowed values:

    • all
    • any Generated.
    providerOauth2DcrId string
    refreshTokenValidity string
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    oauth2_provider float
    PK of the OAuth2 provider dynamic client registration applies to.
    access_token_validity str
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    allowed_grant_types Sequence[str]
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    default_application_group str
    Group to assign to automatically created applications.
    override_authorization_flow str
    Authorization flow applied to dynamically registered clients.
    override_invalidation_flow str
    override_property_mappings Sequence[str]
    policy_engine_mode str
    Allowed values:

    • all
    • any Generated.
    provider_oauth2_dcr_id str
    refresh_token_validity str
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    oauth2Provider Number
    PK of the OAuth2 provider dynamic client registration applies to.
    accessTokenValidity String
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    allowedGrantTypes List<String>
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    defaultApplicationGroup String
    Group to assign to automatically created applications.
    overrideAuthorizationFlow String
    Authorization flow applied to dynamically registered clients.
    overrideInvalidationFlow String
    overridePropertyMappings List<String>
    policyEngineMode String
    Allowed values:

    • all
    • any Generated.
    providerOauth2DcrId String
    refreshTokenValidity String
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ProviderOauth2Dcr resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing ProviderOauth2Dcr Resource

    Get an existing ProviderOauth2Dcr resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ProviderOauth2DcrState, opts?: CustomResourceOptions): ProviderOauth2Dcr
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        access_token_validity: Optional[str] = None,
        allowed_grant_types: Optional[Sequence[str]] = None,
        default_application_group: Optional[str] = None,
        oauth2_provider: Optional[float] = None,
        override_authorization_flow: Optional[str] = None,
        override_invalidation_flow: Optional[str] = None,
        override_property_mappings: Optional[Sequence[str]] = None,
        policy_engine_mode: Optional[str] = None,
        provider_oauth2_dcr_id: Optional[str] = None,
        refresh_token_validity: Optional[str] = None) -> ProviderOauth2Dcr
    func GetProviderOauth2Dcr(ctx *Context, name string, id IDInput, state *ProviderOauth2DcrState, opts ...ResourceOption) (*ProviderOauth2Dcr, error)
    public static ProviderOauth2Dcr Get(string name, Input<string> id, ProviderOauth2DcrState? state, CustomResourceOptions? opts = null)
    public static ProviderOauth2Dcr get(String name, Output<String> id, ProviderOauth2DcrState state, CustomResourceOptions options)
    resources:  _:    type: authentik:ProviderOauth2Dcr    get:      id: ${id}
    import {
  to = authentik_provider_oauth2_dcr.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccessTokenValidity string
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    AllowedGrantTypes List<string>
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    DefaultApplicationGroup string
    Group to assign to automatically created applications.
    Oauth2Provider double
    PK of the OAuth2 provider dynamic client registration applies to.
    OverrideAuthorizationFlow string
    Authorization flow applied to dynamically registered clients.
    OverrideInvalidationFlow string
    OverridePropertyMappings List<string>
    PolicyEngineMode string
    Allowed values:

    • all
    • any Generated.
    ProviderOauth2DcrId string
    RefreshTokenValidity string
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    AccessTokenValidity string
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    AllowedGrantTypes []string
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    DefaultApplicationGroup string
    Group to assign to automatically created applications.
    Oauth2Provider float64
    PK of the OAuth2 provider dynamic client registration applies to.
    OverrideAuthorizationFlow string
    Authorization flow applied to dynamically registered clients.
    OverrideInvalidationFlow string
    OverridePropertyMappings []string
    PolicyEngineMode string
    Allowed values:

    • all
    • any Generated.
    ProviderOauth2DcrId string
    RefreshTokenValidity string
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    access_token_validity string
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    allowed_grant_types list(string)
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    default_application_group string
    Group to assign to automatically created applications.
    oauth2_provider number
    PK of the OAuth2 provider dynamic client registration applies to.
    override_authorization_flow string
    Authorization flow applied to dynamically registered clients.
    override_invalidation_flow string
    override_property_mappings list(string)
    policy_engine_mode string
    Allowed values:

    • all
    • any Generated.
    provider_oauth2_dcr_id string
    refresh_token_validity string
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    accessTokenValidity String
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    allowedGrantTypes List<String>
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    defaultApplicationGroup String
    Group to assign to automatically created applications.
    oauth2Provider Double
    PK of the OAuth2 provider dynamic client registration applies to.
    overrideAuthorizationFlow String
    Authorization flow applied to dynamically registered clients.
    overrideInvalidationFlow String
    overridePropertyMappings List<String>
    policyEngineMode String
    Allowed values:

    • all
    • any Generated.
    providerOauth2DcrId String
    refreshTokenValidity String
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    accessTokenValidity string
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    allowedGrantTypes string[]
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    defaultApplicationGroup string
    Group to assign to automatically created applications.
    oauth2Provider number
    PK of the OAuth2 provider dynamic client registration applies to.
    overrideAuthorizationFlow string
    Authorization flow applied to dynamically registered clients.
    overrideInvalidationFlow string
    overridePropertyMappings string[]
    policyEngineMode string
    Allowed values:

    • all
    • any Generated.
    providerOauth2DcrId string
    refreshTokenValidity string
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    access_token_validity str
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    allowed_grant_types Sequence[str]
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    default_application_group str
    Group to assign to automatically created applications.
    oauth2_provider float
    PK of the OAuth2 provider dynamic client registration applies to.
    override_authorization_flow str
    Authorization flow applied to dynamically registered clients.
    override_invalidation_flow str
    override_property_mappings Sequence[str]
    policy_engine_mode str
    Allowed values:

    • all
    • any Generated.
    provider_oauth2_dcr_id str
    refresh_token_validity str
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    accessTokenValidity String
    Maximum access token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.
    allowedGrantTypes List<String>
    If empty, all grant types are allowed. Allowed values:

    • authorization_code
    • implicit
    • hybrid
    • refresh_token
    • client_credentials
    • password
    • urn:ietf:params:oauth:grant-type:device_code
    • urn:ietf:params:oauth:grant-type:token-exchange
    defaultApplicationGroup String
    Group to assign to automatically created applications.
    oauth2Provider Number
    PK of the OAuth2 provider dynamic client registration applies to.
    overrideAuthorizationFlow String
    Authorization flow applied to dynamically registered clients.
    overrideInvalidationFlow String
    overridePropertyMappings List<String>
    policyEngineMode String
    Allowed values:

    • all
    • any Generated.
    providerOauth2DcrId String
    refreshTokenValidity String
    Maximum refresh token validity for registered clients. Format: hours=1;minutes=2;seconds=3. Generated.

    Package Details

    Repository
    authentik goauthentik/terraform-provider-authentik
    License
    Notes
    This Pulumi package is based on the authentik Terraform Provider.
    Viewing docs for authentik 2026.8.0
    published on Wednesday, Sep 9, 2026 by goauthentik
    Schema (JSON)
    goauthentik/terraform-provider-authentik

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial