coder · BobbyHo · Aug 3, 2026 · Jul 24, 2026 · Jul 25, 2026 · Jul 28, 2026
diff --git a/docs/admin/integrations/oauth2-provider.md b/docs/admin/integrations/oauth2-provider.md
@@ -32,12 +32,12 @@
 CODER_EXPERIMENTS=oauth2
 ```

 ## Creating OAuth2 Applications
 
 ### Method 1: Web UI
 
-1. Navigate to **Deployment Settings** → **OAuth2 Applications**
-2. Click **Create Application**
+1. Navigate to **Deployment Settings** > **OAuth2 Applications**.
+2. On the **Applications** tab, select **Add application**.
 3. Fill in the application details:
    - **Name**: Your application name
    - **Callback URL**: `https://yourapp.example.com/callback` (web) or `myapp://callback` (native/desktop)
@@ -71,6 +71,19 @@
 
 Dynamic Client Registration ([RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591)) lets a client register itself against `/oauth2/register` instead of an admin creating the application manually. It's **disabled by default**; an owner must turn it on before any client can self-register.
 
+Change the setting in the web UI:
+
+1. Navigate to **Deployment Settings** > **OAuth2 Applications**.
+2. Select the **Settings** tab.
+3. Select **Enable** or **Disable** next to **Dynamic Client Registration**.
+
+Enabling asks you to confirm first.
+Disabling does not.
+The tab is linkable directly at `https://$CODER_ACCESS_URL/deployment/oauth2-provider/apps?tab=settings`.
+
+Viewing the tab requires permission to view deployment configuration, and changing the setting requires permission to edit it.
+Without edit permission the button is present but inactive, and the page says why.
+
 Check or change the setting with the CLI:
 
 ```sh
@@ -248,7 +261,28 @@
   "$CODER_URL/oauth2/tokens?client_id=$CLIENT_ID"
 ```
 
+This ends existing sessions but leaves the application registered, so it can authorize again.
+
+### Delete an Application
+
+Deleting an application is a separate operation from revoking its tokens.
+It removes the registration itself, so the client cannot authorize again without being registered anew.
+
+In the web UI, navigate to **Deployment Settings** > **OAuth2 Applications**, select the application on the **Applications** tab, then select **Delete**.
+This requires permission to delete OAuth2 applications.
+
+Or with the management API:
+
+```sh
+curl -X DELETE \
+  -H "Authorization: Bearer $CODER_SESSION_TOKEN" \
+  "$CODER_URL/api/v2/oauth2-provider/apps/$APP_ID"
+```
+
+This is also how you remove clients that registered themselves while dynamic client registration was enabled.
+Turning the setting off stops new registrations; it does not remove the ones already there.
+
 ## Testing and Development
 
 Coder provides comprehensive test scripts for OAuth2 development:


diff --git a/site/src/api/api.test.ts b/site/src/api/api.test.ts
@@ -610,4 +610,53 @@ describe("api.ts", () => {
 			);
 		});
 	});
+
+	describe("oauth2 provider settings", () => {
+		const settings: TypesGen.OAuth2ProviderSettings = {
+			dynamic_client_registration_enabled: true,
+		};
+
+		it("gets oauth2 provider settings", async () => {
+			vi.spyOn(axiosInstance, "get").mockResolvedValueOnce({
+				data: settings,
+			});
+
+			const result = await API.getOAuth2ProviderSettings();
+
+			expect(axiosInstance.get).toHaveBeenCalledWith(
+				"/api/v2/oauth2-provider/settings",
+			);
+			expect(result).toStrictEqual(settings);
+		});
+
+		it("propagates errors when getting oauth2 provider settings", async () => {
+			const expectedError = new Error("request failed");
+			vi.spyOn(axiosInstance, "get").mockRejectedValueOnce(expectedError);
+
+			await expect(API.getOAuth2ProviderSettings()).rejects.toBe(expectedError);
+		});
+
+		it("updates oauth2 provider settings", async () => {
+			vi.spyOn(axiosInstance, "put").mockResolvedValueOnce({
+				data: settings,
+			});
+
+			const result = await API.putOAuth2ProviderSettings(settings);
+
+			expect(axiosInstance.put).toHaveBeenCalledWith(
+				"/api/v2/oauth2-provider/settings",
+				settings,
+			);
+			expect(result).toStrictEqual(settings);
+		});
+
+		it("propagates errors when updating oauth2 provider settings", async () => {
+			const expectedError = new Error("request failed");
+			vi.spyOn(axiosInstance, "put").mockRejectedValueOnce(expectedError);
+
+			await expect(API.putOAuth2ProviderSettings(settings)).rejects.toBe(
+				expectedError,
+			);
+		});
+	});
 });
diff --git a/site/src/api/api.ts b/site/src/api/api.ts
@@ -2035,6 +2035,24 @@ class ApiMethods {
 		await this.axios.delete(`/oauth2/tokens?client_id=${appId}`);
 	};
 
+	getOAuth2ProviderSettings =
+		async (): Promise<TypesGen.OAuth2ProviderSettings> => {
+			const resp = await this.axios.get<TypesGen.OAuth2ProviderSettings>(
+				"/api/v2/oauth2-provider/settings",
+			);
+			return resp.data;
+		};
+
+	putOAuth2ProviderSettings = async (
+		data: TypesGen.OAuth2ProviderSettings,
+	): Promise<TypesGen.OAuth2ProviderSettings> => {
+		const resp = await this.axios.put<TypesGen.OAuth2ProviderSettings>(
+			"/api/v2/oauth2-provider/settings",
+			data,
+		);
+		return resp.data;
+	};
+
 	getAuditLogs = async (
 		options: TypesGen.AuditLogsRequest,
 	): Promise<TypesGen.AuditLogResponse> => {

diff --git a/site/src/api/queries/oauth2.test.ts b/site/src/api/queries/oauth2.test.ts
@@ -0,0 +1,82 @@
+import { describe, expect, it, vi } from "vitest";
+import { API } from "#/api/api";
+import type * as TypesGen from "#/api/typesGenerated";
+import { createTestQueryClient } from "#/testHelpers/renderHelpers";
+import { getSettings, oauth2ProviderAppKey, putSettings } from "./oauth2";
+
+vi.mock("#/api/api", () => ({
+	API: {
+		getOAuth2ProviderSettings: vi.fn(),
+		putOAuth2ProviderSettings: vi.fn(),
+	},
+}));
+
+const settings: TypesGen.OAuth2ProviderSettings = {
+	dynamic_client_registration_enabled: true,
+};
+
+describe("getSettings", () => {
+	it("fetches settings via the API client", async () => {
+		const getSettingsMock = vi.mocked(API.getOAuth2ProviderSettings);
+		getSettingsMock.mockResolvedValue(settings);
+
+		const result = await getSettings().queryFn();
+
+		expect(getSettingsMock).toHaveBeenCalled();
+		expect(result).toEqual(settings);
+	});
+});
+
+describe("putSettings", () => {
+	it("delegates directly to the API client", async () => {
+		const putSettingsMock = vi.mocked(API.putOAuth2ProviderSettings);
+		putSettingsMock.mockResolvedValue(settings);
+		const queryClient = createTestQueryClient();
+
+		const result = await putSettings(queryClient).mutationFn(settings);
+
+		expect(putSettingsMock).toHaveBeenCalledWith(settings);
+		expect(result).toEqual(settings);
+	});
+
+	// `invalidateQueries` matches by key prefix, so asserting the settings key
+	// was invalidated says nothing about what else went with it. Seeding an app
+	// query alongside it is what catches a widened invalidation scope, which
+	// would refetch every app on every settings save.
+	it("invalidates the settings query without touching app queries", async () => {
+		const queryClient = createTestQueryClient();
+		const settingsQueryKey = getSettings().queryKey;
+		const appQueryKey = oauth2ProviderAppKey("app-1");
+		queryClient.setQueryData(settingsQueryKey, {
+			dynamic_client_registration_enabled: false,
+		});
+		queryClient.setQueryData(appQueryKey, { id: "app-1" });
+
+		await putSettings(queryClient).onSuccess(settings);
+
+		expect(queryClient.getQueryState(settingsQueryKey)?.isInvalidated).toBe(
+			true,
+		);
+		expect(queryClient.getQueryState(appQueryKey)?.isInvalidated).toBe(false);
+	});
+
+	// Invalidating resolves whether or not the refetch that follows succeeds, and
+	// a failed refetch keeps the query's last successful data. Seeding the cache
+	// from the response the server just returned is what stops a successful save
+	// from rendering the pre-save value under an error alert.
+	it("writes the saved value into the cache", async () => {
+		const queryClient = createTestQueryClient();
+		const settingsQueryKey = getSettings().queryKey;
+		queryClient.setQueryData(settingsQueryKey, {
+			dynamic_client_registration_enabled: false,
+		});
+
+		await putSettings(queryClient).onSuccess({
+			dynamic_client_registration_enabled: true,
+		});
+
+		expect(queryClient.getQueryData(settingsQueryKey)).toEqual({
+			dynamic_client_registration_enabled: true,
+		});
+	});
+});
diff --git a/site/src/api/queries/oauth2.ts b/site/src/api/queries/oauth2.ts
@@ -2,13 +2,15 @@ import type { QueryClient } from "react-query";
 import { API } from "#/api/api";
 import type * as TypesGen from "#/api/typesGenerated";
 
-const oauth2ProviderAppsKey = ["oauth2-provider", "apps"];
+const oauth2ProviderKey = ["oauth2-provider"];
+export const oauth2ProviderAppsKey = oauth2ProviderKey.concat("apps");
 export const oauth2ProviderAppKey = (appId: string) =>
 	oauth2ProviderAppsKey.concat(appId);
 export const oauth2ProviderAppSecretsKey = (appId: string) =>
 	oauth2ProviderAppKey(appId).concat("secrets");
 
 const userAppsKey = (userId: string) => oauth2ProviderAppsKey.concat(userId);
+export const oauth2ProviderSettingsKey = oauth2ProviderKey.concat("settings");
 
 export const getGitHubDevice = () => {
 	return {
@@ -121,3 +123,26 @@ export const revokeApp = (queryClient: QueryClient, userId: string) => {
 		},
 	};
 };
+
+export const getSettings = () => {
+	return {
+		queryKey: oauth2ProviderSettingsKey,
+		queryFn: () => API.getOAuth2ProviderSettings(),
+	};
+};
+
+export const putSettings = (queryClient: QueryClient) => {
+	return {
+		mutationFn: API.putOAuth2ProviderSettings,
+		// Seed from the response before invalidating. Invalidating resolves
+		// whether or not the refetch succeeds, and a failed refetch keeps the
+		// last successful data, which would render the pre-save value under an
+		// error alert for a save that worked.
+		onSuccess: async (settings: TypesGen.OAuth2ProviderSettings) => {
+			queryClient.setQueryData(oauth2ProviderSettingsKey, settings);
+			await queryClient.invalidateQueries({
+				queryKey: oauth2ProviderSettingsKey,
+			});
+		},
+	};
+};
diff --git a/site/src/components/Dialog/ConfirmDialog/ConfirmDialog.tsx b/site/src/components/Dialog/ConfirmDialog/ConfirmDialog.tsx
@@ -53,6 +53,13 @@ export interface ConfirmDialogProps {
 	 * Defaults to shown for "delete", hidden for "info"/"success".
 	 */
 	readonly hideCancel?: boolean;
+	/**
+	 * Forwarded to Radix. This dialog renders no `DialogTrigger`, so Radix has
+	 * nothing to return focus to on close and it lands on `<body>`. Callers that
+	 * open it from a control the user should return to can preventDefault here
+	 * and focus that control instead.
+	 */
+	readonly onCloseAutoFocus?: (event: Event) => void;
 }
 
 /**
@@ -66,6 +73,7 @@ export const ConfirmDialog: FC<ConfirmDialogProps> = ({
 	disabled = false,
 	hideCancel,
 	onClose,
+	onCloseAutoFocus,
 	onConfirm,
 	open = false,
 	title,
@@ -88,6 +96,7 @@ export const ConfirmDialog: FC<ConfirmDialogProps> = ({
 			<DialogContent
 				variant={type === "delete" ? "destructive" : "default"}
 				data-testid="dialog"
+				onCloseAutoFocus={onCloseAutoFocus}
 			>
 				<DialogHeader>
 					<DialogTitle>{title}</DialogTitle>