---
title: "RFC 7591 Dynamic Client Registration"
method: POST
path: "/oauth/register"
tags: ["OAuth"]
---

# RFC 7591 Dynamic Client Registration

`POST /oauth/register`

## Request

- Base URL: `https://api.apphandoff.com/api`
- URL: `https://api.apphandoff.com/api/oauth/register`
- Auth: none required

Idempotent proxy for Supabase Management API client registration.

**Strict input** (per RFC 7591 §2 + §3.2.2): `redirect_uris` is REQUIRED and must
be a non-empty array. The endpoint refuses registration with
`invalid_redirect_uri` instead of silently substituting a default.

Each `redirect_uris` entry must be one of:
- `https://…`
- `http://localhost`, `http://127.0.0.1`, or `http://[::1]` (loopback only)
- any other RFC 3986 custom scheme (e.g. `cursor://`, `claude://`),
  EXCEPT `javascript:`, `data:`, `file:`, `vbscript:` (denylisted).

## Request body

- object
  - `redirect_uris` string[], required: Non-empty array of valid redirect URIs.
  - `client_name` string: Optional human-readable client name. Control characters are stripped.

## Response `201`

Client registered (or existing client returned for idempotent re-registration)

- object
  - `client_id` string, uuid
  - `client_id_issued_at` integer
  - `redirect_uris` string[]
  - `client_name` string
  - `token_endpoint_auth_method` 'none'
  - `grant_types` string[]
  - `response_types` string[]

## Other responses

- `400`: RFC 7591 error envelope (`{ error, error_description }`). Error codes: - `invalid_client_metadata` — body is not valid JSON - `invalid_redirect_uri` — `redirect_uris` missing/empty/contains invalid entry
- `500`: Server error

---

[API](https://skmtc.dev/apphandoff/apis/apphandoff-api.md) · [All operations](https://skmtc.dev/apphandoff/apis/apphandoff-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apphandoff/apis/apphandoff-api/revisions/9f138fe46d56?raw)