---
title: "[cloud-only] Dynamic Client Registration (RFC 7591)"
method: POST
path: "/oauth/register"
tags: ["auth"]
---

# \[cloud-only\] Dynamic Client Registration (RFC 7591)

`POST /oauth/register`

[cloud-only] Public, unauthenticated, insert-only RFC 7591 §3.1 client registration. Used by MCP-spec-compliant clients to self-register a public OAuth client without operator involvement.

Policy:

- Public clients only — `token_endpoint_auth_method` is forced to `none`. Confidential-client registration is out of scope this phase.
- Server-owned `resource_grants`. Caller-supplied `scope` or `resource_grants` is rejected as `invalid_client_metadata` (would be a privilege-escalation surface). Dynamic clients receive the same scopes the active resource publishes.
- Application-type-aware redirect URI policy. `application_type=native` accepts loopback (`127.0.0.1`, `::1`, `localhost`) and reverse-DNS-shaped custom schemes; `application_type=web` accepts HTTPS to hosts in an operator-controlled allowlist only. `application_type` is REQUIRED on the request — missing or empty rejects with `invalid_client_metadata`.
- Anti-impersonation: reserved client names are rejected from third parties via NFKC-folded compare.
- Generated `client_id` carries a stable prefix to distinguish dynamic from seeded clients in audit logs.
- Cache-Control: `no-store` on every 201 and 400 response (the response carries fresh credentials and rejection reasons).

## Request body

- OAuthRegisterRequest — [cloud-only] RFC 7591 §2 client metadata document. Only the fields the server honors are listed; presence of `scope` or `resource_grants` in the request is rejected (`invalid_client_metadata`) because those are server-owned for dynamic clients.
  - `redirect_uris` string[], required — 1–5 redirect URIs. Validated against `application_type` policy.
  - `client_name` string — Human-readable name shown in the consent UI. Reserved-name list rejects impersonation of major clients.
  - `application_type` 'native' | 'web', required — RFC 7591 §2 application_type. **REQUIRED** — clients MUST declare intent; the server does not default this field. `native` for desktop / CLI / MCP-spec-strict clients (loopback redirects); `web` for hosted clients (HTTPS only, host must be allowlisted). A missing or explicitly empty `application_type` rejects with `invalid_client_metadata`.
  - `token_endpoint_auth_method` 'none' — Public clients only this phase — must be `none` if present. The server forces `none` regardless.
  - `grant_types` string[] — Optional. Defaults to `["authorization_code","refresh_token"]`.
  - `response_types` string[] — Optional. Defaults to `["code"]`.
  - `scope` string, nullable — **REJECTED IF PRESENT.** Dynamic clients do not pick scopes — the server assigns scopes from the active resource's published list. Sending `scope` in the registration body is treated as a privilege-escalation attempt and returns `invalid_client_metadata`.
  - `resource_grants` object, nullable — **REJECTED IF PRESENT.** Same reason as `scope`. The set of resources and scopes a dynamic client may request is server-policy, not request-driven.
  - `client_uri` string, nullable — **REJECTED IF PRESENT.** Unsupported RFC 7591 metadata for this public-client phase.
  - `logo_uri` string, nullable — **REJECTED IF PRESENT.** Unsupported RFC 7591 metadata for this public-client phase.
  - `tos_uri` string, nullable — **REJECTED IF PRESENT.** Unsupported RFC 7591 metadata for this public-client phase.
  - `policy_uri` string, nullable — **REJECTED IF PRESENT.** Unsupported RFC 7591 metadata for this public-client phase.
  - `software_id` string, nullable — **REJECTED IF PRESENT.** Unsupported RFC 7591 metadata for this public-client phase.
  - `software_version` string, nullable — **REJECTED IF PRESENT.** Unsupported RFC 7591 metadata for this public-client phase.
  - `contacts` string[], nullable — **REJECTED IF PRESENT.** Unsupported RFC 7591 metadata for this public-client phase.
  - `jwks` object, nullable — **REJECTED IF PRESENT.** Unsupported RFC 7591 metadata for this public-client phase.
  - `jwks_uri` string, nullable — **REJECTED IF PRESENT.** Unsupported RFC 7591 metadata for this public-client phase.

## Response `201`

Registered. Body echoes the metadata RFC 7591 §3.2.1 requires.

- OAuthRegisterResponse — [cloud-only] RFC 7591 §3.2.1 successful registration response.
  - `client_id` string, required — Server-generated client_id.
  - `client_id_issued_at` integer, required — Unix timestamp (seconds) when the client was registered.
  - `client_name` string
  - `redirect_uris` string[], required
  - `grant_types` string[], required
  - `response_types` string[], required
  - `token_endpoint_auth_method` 'none', required
  - `application_type` 'native' | 'web', required

## Other responses

- `400` — RFC 7591 §3.2.2 invalid client metadata
- `404` — OAuth disabled
- `503` — No active resource is configured — DCR cannot mint a usable client until an active resource row is seeded.

## Changes

- **2026-05-21** `eda7dd3d95f1` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/comfy-org/apis/comfyui-api/changes/oauth/register/post.md)

---

[API](https://skmtc.dev/comfy-org/apis/comfyui-api.md) · [All operations](https://skmtc.dev/comfy-org/apis/comfyui-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/comfy-org/comfyui-api/revisions/c4db9e1283df/schema)