AWS CDK Reference

Appearance

v2.275.0

CustomOAuth2CredentialProviderProps Struct ​

Props for {@link OAuth2CredentialProvider.usingCustom}.

Set exactly one of {@link discoveryUrl} (OIDC discovery document) or {@link authorizationServerMetadata} (static OAuth2 server metadata). Do not pass both.

Source
aws-bedrockagentcore/lib/identity/oauth2-credential-provider.ts
Type last changed
v2.255.0 · 19 May 2026

Example ​

ts
agentcore.OAuth2CredentialProvider.usingCustom(this, "CustomOAuth", {
  oAuth2CredentialProviderName: "custom-idp",
  clientId: "your-client-id",
  clientSecret: cdk.SecretValue.unsafePlainText("your-client-secret"),
  discoveryUrl: "https://idp.example.com/.well-known/openid-configuration",
});

Properties ​

authorizationServerMetadataoptionalOAuth2AuthorizationServerMetadataauthorization_server_metadataoptionalOAuth2AuthorizationServerMetadataauthorizationServerMetadataoptionalOAuth2AuthorizationServerMetadataAuthorizationServerMetadataoptionalOAuth2AuthorizationServerMetadataAuthorizationServerMetadataoptionalOAuth2AuthorizationServerMetadata#
Authorization server metadata (issuer, authorization and token endpoints) when not using a discovery URL.

Default: not used when {@link discoveryUrl } is set

clientIdstringclient_idstrclientIdStringClientIdstringClientId*stringrequired#
OAuth2 client identifier.
clientSecretSecretValueclient_secretSecretValueclientSecretSecretValueClientSecretSecretValueClientSecretSecretValuerequired#
OAuth2 client secret.
notes

NOTE: The client secret will be included in the CloudFormation template as part of synthesis. The service stores the secret in Secrets Manager after creation, but the value is visible in the template and deployment history. Use SecretValue.unsafePlainText() to explicitly acknowledge plaintext, or pass a reference from another construct to avoid embedding the literal value.

discoveryUrloptionalstringdiscovery_urloptionalstrdiscoveryUrloptionalStringDiscoveryUrloptionalstringDiscoveryUrloptional*string#
OIDC/OAuth2 discovery document URL for dynamic integration with the identity provider.

Default: not used when {@link authorizationServerMetadata } is set

oAuth2CredentialProviderNameoptionalstringo_auth2_credential_provider_nameoptionalstroAuth2CredentialProviderNameoptionalStringOAuth2CredentialProviderNameoptionalstringOAuth2CredentialProviderNameoptional*string#
Name of the credential provider.

Default: a name generated by CDK

tagsoptional{ [key: string]: string }tagsoptionaltyping.Mapping[str, str]tagsoptionalMap<String, String>TagsoptionalIDictionary<string, string>Tagsoptional*map[string]*string#
Tags for this credential provider.

Default: no tags