---
title: "Dynamic Client Registration (RFC 7591)"
method: POST
path: "/oauth/register"
tags: ["OAuth"]
---

# Dynamic Client Registration (RFC 7591)

`POST /oauth/register`

## Request

- Base URL: `https://app.buildworkpro.com/api/v1`
- URL: `https://app.buildworkpro.com/api/v1/oauth/register`
- Auth: none required

Self-registers a new OAuth client. Public endpoint — no authentication required. Per-IP rate-limited to 5 requests/minute. Each redirect_uri must be https, a loopback http URL on any port (http://127.0.0.1:{port}, http://localhost:{port}, http://[::1]:{port} — RFC 8252 §7.3), or a private-use scheme such as cursor:// (RFC 8252 §7.1); script-injection schemes (javascript:, data:, file:, blob:), embedded credentials, and fragments are rejected.

## Request body

- OauthClientRegistrationRequest
  - `client_name` string, required
  - `redirect_uris` string[], required
  - `grant_types` string[]
  - `scope` string
  - `token_endpoint_auth_method` 'none' | 'client_secret_basic' | 'client_secret_post'
  - `contact` string, email

## Response `201`

Client registered

- OauthClientRegistration
  - `client_id` string, required
  - `client_secret` string
  - `client_id_issued_at` integer, required
  - `client_name` string, required
  - `client_secret_expires_at` integer
  - `redirect_uris` string[], required
  - `grant_types` string[], required
  - `scope` string, required
  - `token_endpoint_auth_method` 'none' | 'client_secret_basic' | 'client_secret_post', required

## Other responses

- `400`: RFC 7591 error envelope (invalid_client_metadata, invalid_redirect_uri, invalid_scope)
- `429`: Per-IP rate limit exceeded

---

[API](https://skmtc.dev/buildworkpro/apis/buildworkpro-api.md) · [All operations](https://skmtc.dev/buildworkpro/apis/buildworkpro-api/llms.txt) · [OpenAPI document](https://skmtc.dev/buildworkpro/apis/buildworkpro-api/revisions/441cf40012f7?raw)