feat: add OAuth2 provider support to identity

src/core/identity.tsx

@@ -1,19 +1,31 @@
 import {
   CreateApiKeyCredentialProviderCommand,
+  CreateOauth2CredentialProviderCommand,
   DeleteApiKeyCredentialProviderCommand,
+  DeleteOauth2CredentialProviderCommand,
   GetApiKeyCredentialProviderCommand,
+  GetOauth2CredentialProviderCommand,
   ListApiKeyCredentialProvidersCommand,
+  ListOauth2CredentialProvidersCommand,
   UpdateApiKeyCredentialProviderCommand,
+  UpdateOauth2CredentialProviderCommand,
   type CreateApiKeyCredentialProviderResponse,
+  type CreateOauth2CredentialProviderResponse,
   type DeleteApiKeyCredentialProviderResponse,
+  type DeleteOauth2CredentialProviderResponse,
   type GetApiKeyCredentialProviderResponse,
+  type GetOauth2CredentialProviderResponse,
   type ListApiKeyCredentialProvidersResponse,
+  type ListOauth2CredentialProvidersResponse,
   type UpdateApiKeyCredentialProviderResponse,
+  type UpdateOauth2CredentialProviderResponse,
 } from "@aws-sdk/client-bedrock-agentcore-control";
 import type {
   CoreIdentityClient,
   CreateApiKeyCredentialProviderInput,
+  CreateOauth2CredentialProviderInput,
   UpdateApiKeyCredentialProviderInput,
+  UpdateOauth2CredentialProviderInput,
 } from "../handlers/identity/types";
 import type { AwsClients, CoreOptions } from "./types";
 import { toClientConfig } from "./utils";
@@ -66,4 +78,50 @@ export class IdentityClient implements CoreIdentityClient {
       .control(toClientConfig(options))
       .send(new DeleteApiKeyCredentialProviderCommand({ name }));
   }
+
+  async createOauth2CredentialProvider(
+    input: CreateOauth2CredentialProviderInput,
+    options: CoreOptions,
+  ): Promise<CreateOauth2CredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new CreateOauth2CredentialProviderCommand(input));
+  }
+
+  async getOauth2CredentialProvider(
+    name: string,
+    options: CoreOptions,
+  ): Promise<GetOauth2CredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new GetOauth2CredentialProviderCommand({ name }));
+  }
+
+  async listOauth2CredentialProviders(
+    nextToken: string | undefined,
+    maxResults: number | undefined,
+    options: CoreOptions,
+  ): Promise<ListOauth2CredentialProvidersResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new ListOauth2CredentialProvidersCommand({ nextToken, maxResults }));
+  }
+
+  async updateOauth2CredentialProvider(
+    input: UpdateOauth2CredentialProviderInput,
+    options: CoreOptions,
+  ): Promise<UpdateOauth2CredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new UpdateOauth2CredentialProviderCommand(input));
+  }
+
+  async deleteOauth2CredentialProvider(
+    name: string,
+    options: CoreOptions,
+  ): Promise<DeleteOauth2CredentialProviderResponse> {
+    return this.clients
+      .control(toClientConfig(options))
+      .send(new DeleteOauth2CredentialProviderCommand({ name }));
+  }
 }

src/handlers/identity/api-key-credential-provider/create/index.tsx

@@ -6,7 +6,7 @@ import type { Core } from "../../../types";
 import type { AppIO } from "../../../../io";
 import { coreOptsFromCtx, parseTags } from "../../../utils";
 import { SourceResolver } from "../../../../io";
-import { parseSecretReference } from "../parser";
+import { parseSecretReference } from "../../parser";
 
 export const createCreateApiKeyCredentialProviderHandler = (core: Core, io: AppIO) =>
   createHandler({
@@ -46,7 +46,7 @@ export const createCreateApiKeyCredentialProviderHandler = (core: Core, io: AppI
       const resolver = new SourceResolver({ stdin: io.stdin });
       const apiKey = await resolver.resolveText("api-key", flags["api-key"]);
       const apiKeySecretConfig = hasSecretRef
-        ? parseSecretReference(flags["api-key-secret-reference"]!)
+        ? parseSecretReference("api-key-secret-reference", flags["api-key-secret-reference"]!)
         : undefined;
       const apiKeySecretSource = hasApiKey ? "MANAGED" : "EXTERNAL";
       const tags = parseTags(flags.tags);

src/handlers/identity/api-key-credential-provider/update/index.tsx

@@ -6,7 +6,7 @@ import type { Core } from "../../../types";
 import type { AppIO } from "../../../../io";
 import { coreOptsFromCtx } from "../../../utils";
 import { SourceResolver } from "../../../../io";
-import { parseSecretReference } from "../parser";
+import { parseSecretReference } from "../../parser";
 
 export const createUpdateApiKeyCredentialProviderHandler = (core: Core, io: AppIO) =>
   createHandler({
@@ -59,7 +59,7 @@ export const createUpdateApiKeyCredentialProviderHandler = (core: Core, io: AppI
       const resolver = new SourceResolver({ stdin: io.stdin });
       const apiKey = await resolver.resolveText("api-key", flags["api-key"]);
       const apiKeySecretConfig = hasSecretRef
-        ? parseSecretReference(flags["api-key-secret-reference"]!)
+        ? parseSecretReference("api-key-secret-reference", flags["api-key-secret-reference"]!)
         : undefined;
 
       ctx.require(JsonRendererKey).renderJson(

src/handlers/identity/identity.test.tsx

@@ -53,6 +53,7 @@ describe("identity command hierarchy", () => {
 
     expect(identity?.children().map((child) => child.name())).toEqual([
       "api-key-credential-provider",
+      "oauth2-credential-provider",
     ]);
     expect(
       identity
@@ -240,7 +241,7 @@ describe("api-key-credential-provider CRUDL", () => {
         "--api-key-secret-reference",
         '{"jsonKey":"apiKey"}',
       ],
-      /non-empty "secretId"/,
+      /--api-key-secret-reference/,
     ],
     [
       "create: --api-key-secret-reference with unexpected field",
@@ -253,7 +254,7 @@ describe("api-key-credential-provider CRUDL", () => {
         "--api-key-secret-reference",
         '{"secretId":"arn:aws:secretsmanager:us-west-2:123:secret:s","jsonKey":"apiKey","extra":"bad"}',
       ],
-      /unexpected fields/,
+      /--api-key-secret-reference/,
     ],
     [
       "update: --api-key with --api-key-secret-reference",

src/handlers/identity/index.tsx

@@ -2,10 +2,12 @@ import { Router } from "../../router";
 import type { AppIO } from "../../io";
 import type { Core } from "../types";
 import { createApiKeyCredentialProviderHandler } from "./api-key-credential-provider";
+import { createOauth2CredentialProviderHandler } from "./oauth2-credential-provider";
 import { createHelpDefault } from "../help";
 
 export function createIdentityHandler(core: Core, io: AppIO): Router {
   return new Router("identity", "manage AgentCore Identity resources")
     .default(createHelpDefault(io))
-    .handler(createApiKeyCredentialProviderHandler(core, io));
+    .handler(createApiKeyCredentialProviderHandler(core, io))
+    .handler(createOauth2CredentialProviderHandler(core, io));
 }

src/handlers/identity/oauth2-credential-provider/__fixtures__/CreateOauth2CredentialProviderCommand.15e3501198437ba9.json

@@ -0,0 +1,18 @@
+{
+  "clientSecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/oauth2/agentcore-cli-oauth2-fixture-2-f2d9252c-Wver51"
+  },
+  "name": "agentcore-cli-oauth2-fixture-2",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/oauth2credentialprovider/agentcore-cli-oauth2-fixture-2",
+  "clientSecretSource": "MANAGED",
+  "callbackUrl": "https://bedrock-agentcore.us-west-2.amazonaws.com/identities/oauth2/callback/060bb019-777a-45c8-a7dc-d540c1ac8ff9",
+  "oauth2ProviderConfigOutput": {
+    "customOauth2ProviderConfig": {
+      "oauthDiscovery": {
+        "discoveryUrl": "https://example.com/.well-known/openid-configuration"
+      },
+      "clientId": "fixture-client-id-2"
+    }
+  },
+  "status": "READY"
+}

src/handlers/identity/oauth2-credential-provider/__fixtures__/CreateOauth2CredentialProviderCommand.5ccb325cf76fc258.json

@@ -0,0 +1,18 @@
+{
+  "clientSecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/oauth2/agentcore-cli-oauth2-fixture-7aeedc5d-iuTkLZ"
+  },
+  "name": "agentcore-cli-oauth2-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/oauth2credentialprovider/agentcore-cli-oauth2-fixture",
+  "clientSecretSource": "MANAGED",
+  "callbackUrl": "https://bedrock-agentcore.us-west-2.amazonaws.com/identities/oauth2/callback/6b6e9fda-8f15-4c0f-9d48-b82aa39066d8",
+  "oauth2ProviderConfigOutput": {
+    "customOauth2ProviderConfig": {
+      "oauthDiscovery": {
+        "discoveryUrl": "https://example.com/.well-known/openid-configuration"
+      },
+      "clientId": "fixture-client-id"
+    }
+  },
+  "status": "READY"
+}

src/handlers/identity/oauth2-credential-provider/__fixtures__/DeleteOauth2CredentialProviderCommand.1def95784910b125.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/oauth2-credential-provider/__fixtures__/DeleteOauth2CredentialProviderCommand.450abe7018948e2d.json

@@ -0,0 +1 @@
+{}

src/handlers/identity/oauth2-credential-provider/__fixtures__/GetOauth2CredentialProviderCommand.1def95784910b125.json

@@ -0,0 +1,25 @@
+{
+  "clientSecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/oauth2/agentcore-cli-oauth2-fixture-7aeedc5d-iuTkLZ"
+  },
+  "name": "agentcore-cli-oauth2-fixture",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/oauth2credentialprovider/agentcore-cli-oauth2-fixture",
+  "credentialProviderVendor": "CustomOauth2",
+  "oauth2ProviderConfigOutput": {
+    "customOauth2ProviderConfig": {
+      "oauthDiscovery": {
+        "discoveryUrl": "https://example.com/.well-known/openid-configuration"
+      },
+      "clientId": "fixture-client-id"
+    }
+  },
+  "createdTime": {
+    "$date": "2026-07-29T14:48:42.019Z"
+  },
+  "lastUpdatedTime": {
+    "$date": "2026-07-29T14:48:42.019Z"
+  },
+  "clientSecretSource": "MANAGED",
+  "callbackUrl": "https://bedrock-agentcore.us-west-2.amazonaws.com/identities/oauth2/callback/6b6e9fda-8f15-4c0f-9d48-b82aa39066d8",
+  "status": "READY"
+}

src/handlers/identity/oauth2-credential-provider/__fixtures__/GetOauth2CredentialProviderCommand.32c5ac3d87a14dd1.json

@@ -0,0 +1,6 @@
+{
+  "$error": {
+    "name": "ResourceNotFoundException",
+    "message": "CredentialProvider not found"
+  }
+}

src/handlers/identity/oauth2-credential-provider/__fixtures__/ListOauth2CredentialProvidersCommand.23f97c9dcdd6350b.json

@@ -0,0 +1,26 @@
+{
+  "credentialProviders": [
+    {
+      "name": "agentcore-cli-oauth2-fixture",
+      "credentialProviderVendor": "CustomOauth2",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/oauth2credentialprovider/agentcore-cli-oauth2-fixture",
+      "createdTime": {
+        "$date": "2026-07-29T14:48:42.019Z"
+      },
+      "lastUpdatedTime": {
+        "$date": "2026-07-29T14:48:42.019Z"
+      }
+    },
+    {
+      "name": "agentcore-cli-oauth2-fixture-2",
+      "credentialProviderVendor": "CustomOauth2",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/oauth2credentialprovider/agentcore-cli-oauth2-fixture-2",
+      "createdTime": {
+        "$date": "2026-07-29T14:48:42.317Z"
+      },
+      "lastUpdatedTime": {
+        "$date": "2026-07-29T14:48:42.317Z"
+      }
+    }
+  ]
+}

src/handlers/identity/oauth2-credential-provider/__fixtures__/ListOauth2CredentialProvidersCommand.7d2e22c637f6b633.json

@@ -0,0 +1,16 @@
+{
+  "credentialProviders": [
+    {
+      "name": "agentcore-cli-oauth2-fixture",
+      "credentialProviderVendor": "CustomOauth2",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/oauth2credentialprovider/agentcore-cli-oauth2-fixture",
+      "createdTime": {
+        "$date": "2026-07-29T14:48:42.019Z"
+      },
+      "lastUpdatedTime": {
+        "$date": "2026-07-29T14:48:42.019Z"
+      }
+    }
+  ],
+  "nextToken": "eyJBY2NvdW50QW5kVHlwZUdzaVBrIjp7InZhbHVlU3RyIjoiNjg1MTk3NzA4Njg3I09BVVRIMiIsImF0dHJpYnV0ZVR5cGUiOiJTIn0sIlNLIjp7InZhbHVlU3RyIjoiYWdlbnRjb3JlLWNsaS1vYXV0aDItZml4dHVyZSIsImF0dHJpYnV0ZVR5cGUiOiJTIn0sIlBLIjp7InZhbHVlU3RyIjoiQ1JFRFNfUFJPVklERVIjNjg1MTk3NzA4Njg3I2RlZmF1bHQjYWdlbnRjb3JlLWNsaS1vYXV0aDItZml4dHVyZSIsImF0dHJpYnV0ZVR5cGUiOiJTIn19"
+}

src/handlers/identity/oauth2-credential-provider/__fixtures__/ListOauth2CredentialProvidersCommand.d4ab0333e45c9f96.json

@@ -0,0 +1,15 @@
+{
+  "credentialProviders": [
+    {
+      "name": "agentcore-cli-oauth2-fixture-2",
+      "credentialProviderVendor": "CustomOauth2",
+      "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/oauth2credentialprovider/agentcore-cli-oauth2-fixture-2",
+      "createdTime": {
+        "$date": "2026-07-29T14:48:42.317Z"
+      },
+      "lastUpdatedTime": {
+        "$date": "2026-07-29T14:48:42.317Z"
+      }
+    }
+  ]
+}

src/handlers/identity/oauth2-credential-provider/__fixtures__/UpdateOauth2CredentialProviderCommand.16483b6b51f663af.json

@@ -0,0 +1,25 @@
+{
+  "clientSecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/oauth2/agentcore-cli-oauth2-fixture-7aeedc5d-iuTkLZ"
+  },
+  "name": "agentcore-cli-oauth2-fixture",
+  "credentialProviderVendor": "CustomOauth2",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/oauth2credentialprovider/agentcore-cli-oauth2-fixture",
+  "oauth2ProviderConfigOutput": {
+    "customOauth2ProviderConfig": {
+      "oauthDiscovery": {
+        "discoveryUrl": "https://example.com/.well-known/openid-configuration"
+      },
+      "clientId": "updated-client-id"
+    }
+  },
+  "createdTime": {
+    "$date": "2026-07-29T14:48:42.019Z"
+  },
+  "lastUpdatedTime": {
+    "$date": "2026-07-29T14:48:43.091Z"
+  },
+  "clientSecretSource": "MANAGED",
+  "callbackUrl": "https://bedrock-agentcore.us-west-2.amazonaws.com/identities/oauth2/callback/6b6e9fda-8f15-4c0f-9d48-b82aa39066d8",
+  "status": "READY"
+}

src/handlers/identity/oauth2-credential-provider/__fixtures__/create-2.golden.json

@@ -0,0 +1,18 @@
+{
+  "clientSecretArn": {
+    "secretArn": "arn:aws:secretsmanager:us-west-2:685197708687:secret:bedrock-agentcore-identity!default/oauth2/agentcore-cli-oauth2-fixture-2-f2d9252c-Wver51"
+  },
+  "name": "agentcore-cli-oauth2-fixture-2",
+  "credentialProviderArn": "arn:aws:bedrock-agentcore:us-west-2:685197708687:token-vault/default/oauth2credentialprovider/agentcore-cli-oauth2-fixture-2",
+  "clientSecretSource": "MANAGED",
+  "callbackUrl": "https://bedrock-agentcore.us-west-2.amazonaws.com/identities/oauth2/callback/060bb019-777a-45c8-a7dc-d540c1ac8ff9",
+  "oauth2ProviderConfigOutput": {
+    "customOauth2ProviderConfig": {
+      "oauthDiscovery": {
+        "discoveryUrl": "https://example.com/.well-known/openid-configuration"
+      },
+      "clientId": "fixture-client-id-2"
+    }
+  },
+  "status": "READY"
+}