> ## Documentation Index
> Fetch the complete documentation index at: https://docs.korve.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Config

> Create or update app-auth policy using exact browser origins and redirect URLs.



## OpenAPI

````yaml /openapi.json put /v1/orgs/{orgId}/projects/{projectId}/auth
openapi: 3.1.0
info:
  title: Korve API
  version: 0.1.0
  description: >-
    Typed control plane for deploying applications and explicitly provisioning
    their managed infrastructure.
servers:
  - url: https://api.korve.dev
security: []
paths:
  /v1/orgs/{orgId}/projects/{projectId}/auth:
    put:
      tags:
        - appauth
      summary: Update Config
      description: >-
        Create or update app-auth policy using exact browser origins and
        redirect URLs.
      operationId: appauth.updateConfig
      parameters:
        - name: orgId
          in: path
          required: true
          schema:
            type: string
          description: The organization's id (UUID) or slug — either form is accepted.
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: The project's id (UUID) or slug — either form is accepted.
      requestBody:
        required: true
        x-korve-max-bytes: 1048576
        content:
          application/json:
            schema:
              type: object
              properties:
                enabled:
                  type: boolean
                allowedOrigins:
                  type: array
                  description: Exact browser origins. Wildcards are not accepted.
                  items:
                    type: string
                redirectUrls:
                  type: array
                  description: >-
                    Exact post-sign-in redirect URLs. HTTPS is required except
                    for loopback localhost URLs.
                  items:
                    type: string
                accessTokenTtlSeconds:
                  type: integer
                  description: 300-3600 seconds.
                refreshTokenTtlSeconds:
                  type: integer
                  description: 3600-2592000 seconds.
                sessionIdleTtlSeconds:
                  type: integer
                  description: 900-604800 seconds.
                sessionMaxTtlSeconds:
                  type: integer
                  description: 3600-2592000 seconds.
              required:
                - enabled
                - allowedOrigins
                - redirectUrls
              additionalProperties: false
      responses:
        '200':
          description: Updated app-auth configuration.
          content:
            application/json:
              schema:
                type: object
                properties:
                  enabled:
                    type: boolean
                  allowedOrigins:
                    type: array
                    description: Exact browser origins. Wildcards are not accepted.
                    items:
                      type: string
                  redirectUrls:
                    type: array
                    description: >-
                      Exact post-sign-in redirect URLs. HTTPS is required except
                      for loopback localhost URLs.
                    items:
                      type: string
                  accessTokenTtlSeconds:
                    type: integer
                  refreshTokenTtlSeconds:
                    type: integer
                  sessionIdleTtlSeconds:
                    type: integer
                  sessionMaxTtlSeconds:
                    type: integer
                  google:
                    type: object
                    properties:
                      enabled:
                        type: boolean
                      clientId:
                        type:
                          - string
                          - 'null'
                      secretConfigured:
                        type: boolean
                      secretVersion:
                        type:
                          - integer
                          - 'null'
                      rotatedAt:
                        type:
                          - string
                          - 'null'
                        format: date-time
                    required:
                      - enabled
                      - clientId
                      - secretConfigured
                      - secretVersion
                      - rotatedAt
                  callbackUrl:
                    type: string
                    description: >-
                      Exact Google OAuth callback URL to register for this
                      project.
                  createdAt:
                    type: string
                    format: date-time
                  updatedAt:
                    type: string
                    format: date-time
                required:
                  - enabled
                  - allowedOrigins
                  - redirectUrls
                  - accessTokenTtlSeconds
                  - refreshTokenTtlSeconds
                  - sessionIdleTtlSeconds
                  - sessionMaxTtlSeconds
                  - google
                  - callbackUrl
                  - createdAt
                  - updatedAt
        '404':
          description: No such project or app-auth resource in this organization.
        '422':
          description: Invalid configuration or request.
      security:
        - apiKey: []
        - session: []
components:
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: korve_api_key
    session:
      type: apiKey
      in: cookie
      name: korve.session_token

````