ctxindex oauth-app
Inspect available OAuth Apps and manage local BYOA configuration.
An OAuth App is one labeled application definition for a Provider. It may come from a trusted Extension or from local bring-your-own-app configuration. Its exact identity is the pair of Provider id and label.
Usage
ctxindex oauth-app add <provider> <label> --from-env
ctxindex oauth-app list [--json]
ctxindex oauth-app remove <provider> <label>Commands and flags
| Command or flag | Purpose |
|---|---|
add <provider> <label> | Add one local OAuth App. Unknown Providers and identity collisions fail before secret or network effects. |
--from-env | Read the selected Provider's complete declared environment mapping once, validate it, and persist the config through the active secret backend. |
list | List Extension and local Apps without exposing config values, config keys, client ids, or secret references. |
remove <provider> <label> | Remove one local App and its config. Existing Accounts keep refreshing through their Grant-owned snapshots. Extension Apps cannot be removed through this command. |
Use ctxindex describe to discover active Providers and ctxindex oauth-app list to discover exact App labels. Config values and generic JSON are not accepted as command arguments.
ctxindex account add <provider> may omit --app only when one active Extension App exactly matches the host's managed-App policy. Omission never guesses a local or unreviewed App. To choose any App deterministically, including local BYOA, pass its exact label:
ctxindex account add <provider> --app <label>If no managed default is available, create a local App from the Provider's environment mapping and then select it explicitly:
ctxindex oauth-app add <provider> <label> --from-env
ctxindex account add <provider> --app <label>JSON output
Only oauth-app list accepts --json. Each item contains only Provider id, label, origin, and safe provenance.
Stable exit codes
Exit codes are API: 0 success; 2 invalid usage or a selection collision; 10 needs_auth; 20 rate limited; 30 network/provider; 40 permission denied; 50 other sync failure; 130 cancelled by SIGINT.