--- title: "ezgh sso applications update" description: "Change an application's name or settings." --- > Documentation Index > Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt > Use this file to discover all available pages before exploring further. # ezgh sso applications update {/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */} ```sh ezgh sso applications update [--name n] [--description d] [settings] [--logo file | --remove-logo] [flags] ``` Change an application. What's given changes and the rest stays; `--redirect-uri`, `--post-logout-redirect-uri`, `--acs-url` and `--attribute` replace their lists, and `--signing-certificate` and `--encryption-certificate` replace the service provider's certificates of that use. `--initiate-login-uri`, `--backchannel-logout-uri`, `--jwks-uri`, `--jwks`, `--access-token-audience`, `--launch-url`, `--slo-url` and `--default-relay-state` take "" to clear them. A saml application's `--metadata-url` or `--metadata-file` imports the service provider's metadata again (flags given with it win). An application's kind and type can't change. `--logo` uploads a PNG or JPEG (at most 512 KiB and 1024×1024) that the portal shows on the application's tile, instead of its EZGH product's mark or its initials; `--remove-logo` removes it. An application MCP Central manages can't be given a logo. Part of [`ezgh sso applications`](/cli/reference/sso-applications). ## Examples ```sh ezgh sso applications update wiki --redirect-uri https://wiki.acme.com/cb --redirect-uri https://wiki.acme.com/cb2 ezgh sso applications update wiki --groups-claim all --access-token-lifetime 30m ezgh sso applications update slack --encrypt-assertions --encryption-certificate slack-encryption.pem ezgh sso applications update wiki --logo wiki.png ``` ## Flags | Flag | Type | Default | Description | | --- | --- | --- | --- | | `--access-token-audience` | string | | for oidc: the access tokens' aud (default: the client ID) | | `--access-token-lifetime` | duration | `15m0s` | for oidc: how long access tokens last, 5m to 1h | | `--acs-url` | strings, comma-separated or repeated | | for saml: an exact assertion consumer service URL, HTTP-POST (repeat, at most 10; the first is the default) | | `--attribute` | string, repeatable | | for saml: an attribute name=template, such as email=${user.email} (repeat; replaces the list; "" for none) | | `--attribute-name-format` | string | | for saml: the NameFormat of the `--attribute` values given: unspecified (the default), uri or basic | | `--auth-method` | string | | for oidc web applications: client_secret_basic (the default), client_secret_post or private_key_jwt | | `--backchannel-logout-uri` | string | | for oidc: where to send OpenID Connect back-channel logout tokens (https) | | `--default-relay-state` | string | | for saml: the RelayState of IdP-initiated sign-in, where the service provider lands ("" for none) | | `--description` | string | | a description | | `--encrypt-assertions` | boolean | | for saml: encrypt assertions to the service provider's encryption certificate | | `--encryption-algorithm` | string | | for saml: aes128-gcm (the default) or aes256-cbc | | `--encryption-certificate` | string, repeatable | | for saml: a PEM file with the service provider's encryption certificate (repeat; "" for none) | | `--entity-id` | string | | for saml: the service provider's entity ID (the assertion's audience) | | `--groups-claim` | string | | for oidc: which groups the groups claim lists, assigned (the default: groups assigned to the application) or all | | `--groups-filter` | string | | for saml: which groups ${user.groups} lists, assigned (the default) or all | | `--id-token-alg` | string | | for oidc: how ID and access tokens are signed, RS256 (the default) or ES256 | | `--idp-initiated` | boolean | `true` | for saml: allow IdP-initiated sign-in (the portal's tile) | | `--initiate-login-uri` | string | | for oidc: where the portal's tile sends people to start signing in (https) | | `--jwks` | string | | for private_key_jwt: the client's public keys as a JWK Set, @file or - for stdin | | `--jwks-uri` | string | | for private_key_jwt: the https URL of the client's public keys | | `--launch-url` | string | | for ezgh: where the portal's tile opens, under the product's URL | | `--logo` | string | | a PNG or JPEG file (at most 512 KiB and 1024×1024) for the application's portal tile | | `--metadata-file` | string | | for saml: import the service provider's metadata from this XML file | | `--metadata-url` | string | | for saml: import the service provider's metadata from this https URL (once; never refreshed) | | `--name` | string | | the application's name, shown on the portal | | `--name-id-format` | string | | for saml: email (the default), persistent (the user's ID) or transient | | `--post-logout-redirect-uri` | strings, comma-separated or repeated | | for oidc: an exact URI to return to after logout (repeat) | | `--product` | string | | for ezgh: the EZGH product (mcpcentral) | | `--redirect-uri` | strings, comma-separated or repeated | | for oidc: an exact redirect URI (repeat for several, at most 20) | | `--remove-logo` | boolean | | remove the application's logo: its tile shows its EZGH product's mark or its initials | | `--resource-token-lifetime` | duration | `1h0m0s` | for ezgh: how long MCP clients' resource tokens last, 5m to 1h | | `--sign-assertion` | boolean | `true` | for saml: sign the Assertion | | `--sign-response` | boolean | `true` | for saml: sign the Response | | `--signing-certificate` | string, repeatable | | for saml: a PEM file with the service provider's signing certificate (repeat; "" for none) | | `--slo-binding` | string | | for saml: HTTP-Redirect (the default) or HTTP-POST | | `--slo-url` | string | | for saml: the service provider's single logout URL ("" for none) | This command also takes the [global flags](/cli/reference#global-flags). Source: https://docs.ezghcloud.com/cli/reference/sso-applications-update/index.mdx