---
title: "Register an app that signs people in [write]"
method: POST
path: "/oauth_clients"
tags: ["oauth_clients"]
---

# Register an app that signs people in \[write\]

`POST /oauth_clients`

## Request

- Base URL: `https://api.agentsky.dev/v1`
- URL: `https://api.agentsky.dev/v1/oauth_clients`
- Auth: HTTP bearer

The app signs a person in with the authorization-code flow and PKCE (S256) at the sign-in service, asking for `openid` plus the scopes registered here and naming this API as the `resource`. The access token it receives is sent as `Authorization: Bearer` to this API. It acts as that person in one workspace: a person who belongs to several chooses it when they allow the app, and the app is refused everywhere else (`universe_mismatch` for another workspace named in `X-Universe`, `not_found` for a session outside it). It holds only the scopes they allowed and reaches tasks, sessions, agents, the catalog and whoami. On a session in that workspace it can also send messages and interrupts (`POST /sessions/{id}/events`, `POST /sessions/{id}/interrupt`, both `write`) and follow the live stream (`GET /sessions/{id}/stream`, `read`). It stops working as soon as the person removes the app from their account page: the next request is refused, and a stream that is open ends within a few seconds. To move the app to another workspace the person removes its access and allows it again. A new app is unreviewed. A caller may register up to 10 apps. Answers 404 until apps with sign-in are open on the platform, and 503 `not_migrated` until its tables are in place.

## Request body

- object
  - `name` string, required: Shown to people when they are asked to allow the app.
  - `redirect_uris` string[], required: Where the app may send people back after they decide. Matched exactly: no wildcards, no fragments. Must be https; `http://localhost` and `http://127.0.0.1` are accepted while the app is not reviewed.
  - `scopes` string[], required: What the app may ask a person for. `read` sees their tasks, agents and sessions; `write` also starts and changes them.
  - `test_users` string[]: People besides you who may use the app before it is reviewed, by the email address of their account.

## Response `201`

Created

- object
  - `oauth_client` OauthClient, required: An app registered to sign people in with their account.
    - `id` string, required: The client id the app presents when it sends a person to sign in.
    - `name` string, required: Shown to people when they are asked to allow the app.
    - `redirect_uris` string[], required: Where the app may send people back after they decide. Matched exactly: no wildcards, no fragments. Must be https; `http://localhost` and `http://127.0.0.1` are accepted while the app is not reviewed.
    - `scopes` string[], required: What the app may ask a person for. `read` sees their tasks, agents and sessions; `write` also starts and changes them.
    - `test_users` string[], required: People besides you who may use the app before it is reviewed, by the email address of their account.
    - `review_status` 'unreviewed' | 'approved', required: An unreviewed app works only for its owner and its test users, and people are told it has not been reviewed.
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
  - `client_secret` string, required: Shown in this response only. Keep it on your server.

## Other responses

- `default`: Error — { error: { code, message } }

## Changes

- **2026-11-02** `e5e8f0229a99`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/agentsky/apis/agentsky-developer-api/changes/oauth_clients/post.md)

---

[API](https://skmtc.dev/agentsky/apis/agentsky-developer-api.md) - [All operations](https://skmtc.dev/agentsky/apis/agentsky-developer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/agentsky/apis/agentsky-developer-api/revisions/0d435187cd55?raw)