Register

RFC 7591 Dynamic Client Registration. Returns the new client's metadata + credentials. client_secret is only returned ONCE (stored as SHA-256 hash from there on).

Minimum request body::

{"redirect_uris": ["https://app.example.com/oauth/callback"]}

Full shape mirroring RFC 7591::

{
  "client_name": "Example App",
  "redirect_uris": ["https://app.example.com/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "scope": "mcp:read api:read",
  "token_endpoint_auth_method": "client_secret_basic"
                                  | "client_secret_post"
                                  | "none",
  "client_uri": "https://app.example.com",
  "logo_uri":   "https://app.example.com/logo.png",
  "tos_uri":    "https://app.example.com/terms",
  "policy_uri": "https://app.example.com/privacy",
  "contacts":   ["dev@app.example.com"]
}