| Field | Tracked |
|---|---|
| id | false |
| notifier_paused | true |
| Field | Tracked |
|---|---|
| callback_url | true |
| client_id_issued_at | false |
| client_secret_expires_at | true |
| client_type | true |
| client_uri | true |
| contacts | true |
| created_at | false |
| dynamically_registered | true |
| grant_types | true |
| icon | true |
| id | false |
| jwks | true |
| jwks_uri | true |
| logo_uri | true |
| name | true |
| policy_uri | true |
| redirect_uris | true |
| registration_access_token | true |
| registration_client_uri | true |
| response_types | true |
| scope | true |
| software_id | true |
| software_version | true |
| token_endpoint_auth_method | true |
| tos_uri | true |
| updated_at | false |
| Field | Tracked |
|---|---|
| app_id | false |
| created_at | false |
| display_secret | false |
| hashed_secret | false |
| id | false |
| last_used_at | false |
| secret_prefix | false |
| Field | Tracked |
|---|---|
| dynamic_client_registration_enabled | true |
| id | false |
| Field | Tracked |
|---|---|
| created_at | false |
| default_org_member_roles | true |
| deleted | true |
| description | true |
| display_name | true |
| icon | true |
| id | false |
| is_default | true |
| name | true |
| shareable_workspace_owners | true |
| updated_at | true |
| Field | Tracked |
|---|---|
| assign_default | true |
| field | true |
| mapping | true |
| Field | Tracked |
|---|---|
| id | false |
| reconciliation_paused | true |
logout](./logout.md) | Unauthenticate your local session |
| [netcheck](./netcheck.md) | Print network debug information for DERP and STUN |
| [notifications](./notifications.md) | Manage Coder notifications |
+| [oauth2-provider](./oauth2-provider.md) | Manage Coder OAuth2 provider settings |
| [organizations](./organizations.md) | Organization related commands |
| [port-forward](./port-forward.md) | Forward ports from a workspace to the local machine. For reverse port forwarding, use "coder ssh -R". |
| [publickey](./publickey.md) | Output your Coder public key used for Git operations |
diff --git a/docs/reference/cli/oauth2-provider.md b/docs/reference/cli/oauth2-provider.md
new file mode 100644
index 0000000000..e3ea5b7638
--- /dev/null
+++ b/docs/reference/cli/oauth2-provider.md
@@ -0,0 +1,31 @@
+
+# oauth2-provider
+
+Manage Coder OAuth2 provider settings
+
+## Usage
+
+```console
+coder oauth2-provider
+```
+
+## Description
+
+```console
+Administrators can use these commands to change OAuth2 provider settings.
+ - Enable dynamic client registration (RFC 7591), allowing OAuth2/MCP clients to
+self-register without an admin creating an app first:
+
+ $ coder oauth2-provider dcr enable
+
+ - Disable dynamic client registration. Clients that already registered are
+unaffected; only new self-registration attempts are rejected:
+
+ $ coder oauth2-provider dcr disable
+```
+
+## Subcommands
+
+| Name | Purpose |
+|----------------------------------------------|------------------------------------------------------|
+| [dcr](./oauth2-provider_dcr.md) | Manage OAuth2 dynamic client registration (RFC 7591) |
diff --git a/docs/reference/cli/oauth2-provider_dcr.md b/docs/reference/cli/oauth2-provider_dcr.md
new file mode 100644
index 0000000000..24904d0334
--- /dev/null
+++ b/docs/reference/cli/oauth2-provider_dcr.md
@@ -0,0 +1,17 @@
+
+# oauth2-provider dcr
+
+Manage OAuth2 dynamic client registration (RFC 7591)
+
+## Usage
+
+```console
+coder oauth2-provider dcr
+```
+
+## Subcommands
+
+| Name | Purpose |
+|----------------------------------------------------------|--------------------------------------------|
+| [enable](./oauth2-provider_dcr_enable.md) | Enable OAuth2 dynamic client registration |
+| [disable](./oauth2-provider_dcr_disable.md) | Disable OAuth2 dynamic client registration |
diff --git a/docs/reference/cli/oauth2-provider_dcr_disable.md b/docs/reference/cli/oauth2-provider_dcr_disable.md
new file mode 100644
index 0000000000..689dacdfa4
--- /dev/null
+++ b/docs/reference/cli/oauth2-provider_dcr_disable.md
@@ -0,0 +1,10 @@
+
+# oauth2-provider dcr disable
+
+Disable OAuth2 dynamic client registration
+
+## Usage
+
+```console
+coder oauth2-provider dcr disable
+```
diff --git a/docs/reference/cli/oauth2-provider_dcr_enable.md b/docs/reference/cli/oauth2-provider_dcr_enable.md
new file mode 100644
index 0000000000..282b94c6c9
--- /dev/null
+++ b/docs/reference/cli/oauth2-provider_dcr_enable.md
@@ -0,0 +1,10 @@
+
+# oauth2-provider dcr enable
+
+Enable OAuth2 dynamic client registration
+
+## Usage
+
+```console
+coder oauth2-provider dcr enable
+```
diff --git a/enterprise/audit/table.go b/enterprise/audit/table.go
index ea66b57933..24cbdcf1dc 100644
--- a/enterprise/audit/table.go
+++ b/enterprise/audit/table.go
@@ -279,6 +279,10 @@ var auditableResourcesTypes = map[any]map[string]Action{
"id": ActionIgnore,
"reconciliation_paused": ActionTrack,
},
+ &database.OAuth2ProviderSettings{}: {
+ "id": ActionIgnore,
+ "dynamic_client_registration_enabled": ActionTrack,
+ },
// TODO: track an ID here when the below ticket is completed:
// https://github.com/coder/coder/pull/6012
&database.License{}: {
diff --git a/enterprise/coderd/oauth2providersettings_audit_test.go b/enterprise/coderd/oauth2providersettings_audit_test.go
new file mode 100644
index 0000000000..bcaa34cebe
--- /dev/null
+++ b/enterprise/coderd/oauth2providersettings_audit_test.go
@@ -0,0 +1,101 @@
+package coderd_test
+
+import (
+ "context"
+ "encoding/json"
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+
+ "github.com/coder/coder/v2/coderd/audit"
+ "github.com/coder/coder/v2/coderd/coderdtest"
+ "github.com/coder/coder/v2/coderd/database"
+ "github.com/coder/coder/v2/coderd/database/dbauthz"
+ "github.com/coder/coder/v2/coderd/database/dbtestutil"
+ "github.com/coder/coder/v2/coderd/util/ptr"
+ "github.com/coder/coder/v2/codersdk"
+ entaudit "github.com/coder/coder/v2/enterprise/audit"
+ "github.com/coder/coder/v2/enterprise/audit/backends"
+ "github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+ "github.com/coder/coder/v2/enterprise/coderd/license"
+ "github.com/coder/coder/v2/testutil"
+)
+
+// TestOAuth2ProviderSettingsAuditDiff guards against a regression where
+// disabling dynamic client registration produced an empty audit diff. The
+// handler only ever set aReq.New, leaving aReq.Old at its zero value
+// (DynamicClientRegistrationEnabled: false). Enabling (false -> true)
+// happened to diff correctly since the zero value matched the real prior
+// state, masking that disabling (true -> false) diffed the zero value
+// against itself and showed no change at all. The mock auditor used in
+// coderd's own oauth2_provider_settings_test.go always returns an empty
+// diff, so only the real enterprise auditor used here can catch this.
+func TestOAuth2ProviderSettingsAuditDiff(t *testing.T) {
+ t.Parallel()
+
+ db, ps := dbtestutil.NewDB(t)
+ auditor := entaudit.NewAuditor(
+ db,
+ entaudit.DefaultFilter,
+ backends.NewPostgres(db, true),
+ )
+
+ ownerClient, _ := coderdenttest.New(t, &coderdenttest.Options{
+ AuditLogging: true,
+ Options: &coderdtest.Options{
+ Database: db,
+ Pubsub: ps,
+ Auditor: auditor,
+ },
+ LicenseOptions: &coderdenttest.LicenseOptions{
+ Features: license.Features{
+ codersdk.FeatureAuditLog: 1,
+ },
+ },
+ })
+ ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+ defer cancel()
+
+ //nolint:gocritic // Updating OAuth2 provider settings is owner-only.
+ _, err := ownerClient.PutOAuth2ProviderSettings(ctx, codersdk.OAuth2ProviderSettings{
+ DynamicClientRegistrationEnabled: ptr.Ref(true),
+ })
+ require.NoError(t, err)
+
+ //nolint:gocritic // Updating OAuth2 provider settings is owner-only.
+ _, err = ownerClient.PutOAuth2ProviderSettings(ctx, codersdk.OAuth2ProviderSettings{
+ DynamicClientRegistrationEnabled: ptr.Ref(false),
+ })
+ require.NoError(t, err)
+
+ // Read straight from the database. AsSystemRestricted is necessary
+ // because the test does not authenticate as an admin when querying the
+ // store directly.
+ rows, err := db.GetAuditLogsOffset(
+ dbauthz.AsSystemRestricted(ctx),
+ database.GetAuditLogsOffsetParams{
+ ResourceType: string(database.ResourceTypeOauth2ProviderSettings),
+ LimitOpt: 10,
+ },
+ )
+ require.NoError(t, err)
+ require.Equal(t, 2, len(rows), "expected exactly two rows")
+ // GetAuditLogsOffset returns entries sorted by time in descending order.
+ enableLog := rows[1].AuditLog
+ disableLog := rows[0].AuditLog
+
+ var enableDiff audit.Map
+ require.NoError(t, json.Unmarshal(enableLog.Diff, &enableDiff))
+ if assert.Contains(t, enableDiff, "dynamic_client_registration_enabled", "tracked field missing from enableDiff") {
+ assert.Equal(t, false, enableDiff["dynamic_client_registration_enabled"].Old)
+ assert.Equal(t, true, enableDiff["dynamic_client_registration_enabled"].New)
+ }
+
+ var disableDiff audit.Map
+ require.NoError(t, json.Unmarshal(disableLog.Diff, &disableDiff))
+ if assert.Contains(t, disableDiff, "dynamic_client_registration_enabled", "tracked field missing from disableDiff") {
+ assert.Equal(t, true, disableDiff["dynamic_client_registration_enabled"].Old)
+ assert.Equal(t, false, disableDiff["dynamic_client_registration_enabled"].New)
+ }
+}
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index c619c53682..4fb23dceea 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -6658,6 +6658,22 @@ export const OAuth2ProviderResponseTypes: OAuth2ProviderResponseType[] = [
"token",
];
+// From codersdk/oauth2.go
+/**
+ * OAuth2ProviderSettings controls deployment-wide OAuth2 provider behavior.
+ *
+ * DynamicClientRegistrationEnabled is a pointer so a PUT can omit it to leave
+ * the current value unchanged, rather than a decoded zero value silently
+ * resetting it to false. This matters once a second field lands in this
+ * struct (e.g. a future initial-access-token requirement): a client built
+ * against an older, single-field version of this struct would otherwise
+ * always encode the newer field's zero value, silently clearing it on every
+ * unrelated update. GET always returns a non-nil value.
+ */
+export interface OAuth2ProviderSettings {
+ readonly dynamic_client_registration_enabled?: boolean;
+}
+
// From codersdk/client.go
/**
* OAuth2RedirectCookie is the name of the cookie that stores the oauth2 redirect.
@@ -7868,6 +7884,7 @@ export type ResourceType =
| "notifications_settings"
| "oauth2_provider_app"
| "oauth2_provider_app_secret"
+ | "oauth2_provider_settings"
| "organization"
| "organization_member"
| "prebuilds_settings"
@@ -7905,6 +7922,7 @@ export const ResourceTypes: ResourceType[] = [
"notifications_settings",
"oauth2_provider_app",
"oauth2_provider_app_secret",
+ "oauth2_provider_settings",
"organization",
"organization_member",
"prebuilds_settings",