auth

[cloud-only] Dynamic Client Registration (RFC 7591)

[cloud-only] Public, unauthenticated, insert-only RFC 7591 §3.1 client registration. Used by MCP-spec-compliant clients to self-register a public OAuth client without operator involvement.

Policy:

Public clients only — token_endpoint_auth_method is forced to none. Confidential-client registration is out of scope this phase.
Server-owned resource_grants. Caller-supplied scope or resource_grants is rejected as invalid_client_metadata (would be a privilege-escalation surface). Dynamic clients receive the same scopes the active resource publishes.
Application-type-aware redirect URI policy. application_type=native accepts loopback (127.0.0.1, ::1, localhost) and reverse-DNS-shaped custom schemes; application_type=web accepts HTTPS to hosts in an operator-controlled allowlist only. application_type is REQUIRED on the request — missing or empty rejects with invalid_client_metadata.
Anti-impersonation: reserved client names are rejected from third parties via NFKC-folded compare.
Generated client_id carries a stable prefix to distinguish dynamic from seeded clients in audit logs.
Cache-Control: no-store on every 201 and 400 response (the response carries fresh credentials and rejection reasons).

post/oauth/register

Request body

redirect_urisstring[] required

1–5 redirect URIs. Validated against application_type policy.

client_namestring

Human-readable name shown in the consent UI. Reserved-name list rejects impersonation of major clients.

application_type'native' | 'web' required

RFC 7591 §2 application_type. REQUIRED — clients MUST declare intent; the server does not default this field. native for desktop / CLI / MCP-spec-strict clients (loopback redirects); web for hosted clients (HTTPS only, host must be allowlisted). A missing or explicitly empty application_type rejects with invalid_client_metadata.

token_endpoint_auth_method'none'

Public clients only this phase — must be none if present. The server forces none regardless.

grant_typesstring[]

Optional. Defaults to ["authorization_code","refresh_token"].

response_typesstring[]

Optional. Defaults to ["code"].

scopestring nullable

REJECTED IF PRESENT. Dynamic clients do not pick scopes — the server assigns scopes from the active resource's published list. Sending scope in the registration body is treated as a privilege-escalation attempt and returns invalid_client_metadata.

resource_grantsobject nullable

REJECTED IF PRESENT. Same reason as scope. The set of resources and scopes a dynamic client may request is server-policy, not request-driven.

client_uristring nullable