Admin settings - Manage OAuth Clients

In Looker, administrators can use the Manage OAuth Clients page to manage identity-based OAuth 2.0 access for external applications without creating API keys or using the API Explorer. This document describes how to enable pre-configured applications, register custom OAuth clients, and manage token revocation.

The Manage OAuth Clients page is located in the Authentication section of the Looker Admin panel. It provides a centralized interface for granting access to developer tools such as the Looker CLI, AI agent Model Context Protocol (MCP) clients, and business intelligence (BI) connectors.

Requirements

To access and manage the Manage OAuth Clients page, the following requirements must be met:

Your Looker instance must be Looker-hosted. Customer-hosted Looker instances aren't supported.
You must have the Admin role on your Looker instance.

Overview

The Manage OAuth Clients page organizes client applications into two tabs:

Application Library: A catalog of pre-configured, Looker-managed OAuth applications, including AI agent Model Context Protocol (MCP) clients, business intelligence (BI) connectors, and developer tools.
Custom Clients: A management interface for registering and configuring your own custom OAuth client applications with customizable callback redirect URIs and group access controls.

A search bar at the top of the page lets you filter applications across both tabs in real time.

Application Library tab

The Application Library tab contains pre-configured OAuth clients that are maintained by Looker. We recommend that you check the Application Library tab first before creating a custom client. If the tool that you want to connect is already pre-configured in the library, you can enable it without registering a new custom client, unless you need a different redirect URI or port.

The Application Library includes pre-configured clients for the following integrations:

AI agent MCP clients: Cursor, VS Code, Claude Code, Claude Desktop, ChatGPT, Gemini CLI, Cline, Windsurf, Antigravity, and the Looker Extension for VS Code.
BI connectors: Connected Sheets, Data Studio, Tableau Desktop, Microsoft Power BI, and Microsoft Excel.
Developer tools: Looker CLI.

Enabling and disabling library applications

Each pre-configured client application in the Application Library has an Enable switch:

Enable: Enable the switch to allow users to authenticate into Looker from that client application by using OAuth.
Disable: Disable the switch to block authorization requests from that client application. Disabling an application immediately revokes and invalidates all active OAuth tokens that were issued to users for that application.

The Client ID for each pre-configured client application is displayed on its row. You can copy the client ID for use in client-side configurations, but the client ID for library applications is immutable and cannot be modified.

Synchronization with the BI Connectors page

The enablement status of BI connectors (including Connected Sheets, Data Studio, Tableau Desktop, Microsoft Power BI, and Microsoft Excel) is automatically synchronized between the Manage OAuth Clients page and the BI Connectors page:

Changing the enablement status of a BI connector switch on the Manage OAuth Clients page automatically updates the corresponding connector switch on the BI Connectors page.
Changing the enablement status of a BI connector switch on the BI Connectors page automatically updates its status on the Manage OAuth Clients page.

Redirect URIs and dynamic port configurations

Looker requires OAuth redirect URIs to match registered values exactly and does not support wildcard redirect URIs.

Standard BI connectors: Use pre-configured, immutable redirect URIs that match the service's official authentication endpoints.
AI agent and MCP clients: Some AI tools use dynamic or ephemeral local ports by default when initiating an OAuth redirect (such as Claude Code or Cline). To accommodate these tools, Looker pre-registers a fixed default port for each library client (for example, port 8080 for Claude Code and Cline, or port 7777 for Gemini CLI).

To use a pre-configured library client that requires a fixed port, choose one of the following options:

Configure the client to use the pre-registered static port: In your client application settings or startup flags, specify the pre-registered port (for example, run Claude Code with --callback-port 8080).
Register a custom client: If you want to use a different port or custom callback URL, register a new client on the Custom Clients tab with your preferred redirect URI.

Custom Clients tab

The Custom Clients tab lets you register and administer custom OAuth 2.0 client applications for internal tools, proprietary integrations, or third-party applications that are not available in the Application Library.

Registering a custom OAuth client

To register a new custom OAuth client, follow these steps:

In the Admin panel, navigate to the Authentication section and select Manage OAuth Clients.
Select the Custom Clients tab.
Click Add New.
In the side panel, complete the following fields:
- Client ID: Enter a unique string identifier for your application. The client ID cannot start with com.looker., which is reserved for Looker-managed applications.
- Client Name: Enter a descriptive display name for the application.
- Description (Optional): Enter a brief description explaining the application's purpose.
- Redirect URIs: Enter one or more authorized callback URIs (for example, https://mycompany.com/oauth/callback or http://localhost:8080/callback). You can enter multiple redirect URIs to support different environments or ports.
- Restrict to Group ID (Optional): Enter the numeric ID of a Looker user group. If a numeric ID is specified, only users who belong to that group can authorize and authenticate into Looker using this application.
Click Add to create the custom client.

Viewing client details

To view detailed information for any custom client application, follow these steps:

On the Custom Clients tab, click the chevron icon on the client's row in the table.
A side panel opens, displaying the client name, client ID, description, the complete list of authorized redirect URIs, and, if configured, the group ID restrictions.

Editing a custom client

To update an existing custom OAuth client application, follow these steps:

On the Custom Clients tab, locate the client application and click the Edit icon on its row.
In the edit side panel, update the Client Name, Description, Redirect URIs, or Restrict to Group ID fields as needed.

Note: The Client ID field cannot be modified after registration. If you need to change the client ID, delete the client and register a new one.
Click Update to save your changes.

Deleting a custom client

To remove a custom OAuth client application, follow these steps:

On the Custom Clients tab, locate the client application and click the Delete (trash) icon on its row.
In the confirmation dialog, click Delete.

Token invalidation and security

To maintain security across connected applications, Looker automatically enforces token revocation. When an administrator deletes a custom client application or disables an application in the Application Library or Custom Clients tab, Looker immediately revokes all active OAuth refresh tokens that were issued to all users for that application. Any authorization codes that were associated with that application are permanently invalidated.

If a user or an application attempts to connect by using revoked credentials, Looker denies authorization and returns an error that indicates that the OAuth client was not found or is not enabled.