diff --git a/ydb/core/kqp/host/kqp_gateway_proxy.cpp b/ydb/core/kqp/host/kqp_gateway_proxy.cpp
index 750a13634cc2..32f20418d9c0 100644
--- a/ydb/core/kqp/host/kqp_gateway_proxy.cpp
+++ b/ydb/core/kqp/host/kqp_gateway_proxy.cpp
@@ -1850,7 +1850,7 @@ class TKqpGatewayProxy : public IKikimrGateway {
                 params.SetDatabase(*database);
             }
             if (const auto& token = settings.Settings.OAuthToken) {
-                params.SetOAuthToken(*token);
+                params.MutableOAuthToken()->SetToken(*token);
             }
             if (const auto& creds = settings.Settings.StaticCredentials) {
                 params.MutableStaticCredentials()->SetUser(creds->UserName);
diff --git a/ydb/core/protos/replication.proto b/ydb/core/protos/replication.proto
index 034eeab4d60f..723df30059c1 100644
--- a/ydb/core/protos/replication.proto
+++ b/ydb/core/protos/replication.proto
@@ -9,13 +9,17 @@ message TStaticCredentials {
     optional string Password = 2 [(Ydb.sensitive) = true];
 }
 
+message TOAuthToken {
+    optional string Token = 1 [(Ydb.sensitive) = true];
+}
+
 message TConnectionParams {
     optional string Endpoint = 1;
     optional string Database = 2;
     // credentials
     oneof Credentials {
         TStaticCredentials StaticCredentials = 3;
-        string OAuthToken = 4 [(Ydb.sensitive) = true];
+        TOAuthToken OAuthToken = 4;
     }
 }
 
diff --git a/ydb/core/tx/replication/controller/replication.cpp b/ydb/core/tx/replication/controller/replication.cpp
index f5c4d14f2319..8d5645ec8db5 100644
--- a/ydb/core/tx/replication/controller/replication.cpp
+++ b/ydb/core/tx/replication/controller/replication.cpp
@@ -98,7 +98,7 @@ class TReplication::TImpl {
                 ydbProxy.Reset(CreateYdbProxy(params.GetEndpoint(), params.GetDatabase(), params.GetStaticCredentials()));
                 break;
             case NKikimrReplication::TConnectionParams::kOAuthToken:
-                ydbProxy.Reset(CreateYdbProxy(params.GetEndpoint(), params.GetDatabase(), params.GetOAuthToken()));
+                ydbProxy.Reset(CreateYdbProxy(params.GetEndpoint(), params.GetDatabase(), params.GetOAuthToken().GetToken()));
                 break;
             default:
                 if (!(State == EState::Removing && !Targets)) {
diff --git a/ydb/core/tx/replication/service/service.cpp b/ydb/core/tx/replication/service/service.cpp
index de8c7cb17a54..9a896e84e059 100644
--- a/ydb/core/tx/replication/service/service.cpp
+++ b/ydb/core/tx/replication/service/service.cpp
@@ -102,7 +102,7 @@ struct TCredentialsKey: std::tuple<TString, TString, TString> {
         case NKikimrReplication::TConnectionParams::kStaticCredentials:
             return TCredentialsKey(params.GetEndpoint(), params.GetDatabase(), params.GetStaticCredentials().GetUser());
         case NKikimrReplication::TConnectionParams::kOAuthToken:
-            return TCredentialsKey(params.GetEndpoint(), params.GetDatabase(), params.GetOAuthToken() /* TODO */);
+            return TCredentialsKey(params.GetEndpoint(), params.GetDatabase(), params.GetOAuthToken().GetToken() /* TODO */);
         default:
             Y_ABORT("Unexpected credentials");
         }
@@ -187,7 +187,7 @@ class TReplicationService: public TActorBootstrapped<TReplicationService> {
             ydbProxy = GetOrCreateYdbProxy(TCredentialsKey::FromParams(params), params.GetStaticCredentials());
             break;
         case NKikimrReplication::TConnectionParams::kOAuthToken:
-            ydbProxy = GetOrCreateYdbProxy(TCredentialsKey::FromParams(params), params.GetOAuthToken());
+            ydbProxy = GetOrCreateYdbProxy(TCredentialsKey::FromParams(params), params.GetOAuthToken().GetToken());
             break;
         default:
             Y_ABORT("Unexpected credentials");