Agents

Register an agent as an OAuth client

Dynamic Client Registration (RFC 7591). An AI assistant registers itself as a public client (PKCE, no secret) and can do nothing until a person approves a grant for it in the console. Registration is open on purpose, so it is bounded: a per-IP hourly budget on top of the global limit, and a client that nobody ever approves into a workspace is deleted after a while. Other client metadata (client_uri, logo_uri, scope, contacts, ...) is accepted and ignored. A client_name that claims a well known brand (Claude, ChatGPT, ...) is refused unless every redirect host belongs to that brand or is a loopback address. Errors use the RFC 7591 envelope.

post/oauth/agent/register

Request

  • Base URL: https://api.customdomain.ai
  • URL: https://api.customdomain.ai/oauth/agent/register
  • Auth: none required

Request body

client_namestring required

Shown to the person who approves the agent. At most 100 characters, with no control or invisible characters and no Latin letters mixed with look-alike letters from another alphabet. A name that claims a well known brand is refused unless every redirect host belongs to that brand or is a loopback address.

redirect_urisstring[] required

Where the authorization code may be sent. https, or http on a loopback host (localhost, 127.0.0.1, ::1) for a program on the person's own computer. No fragment and no user information. A redirect URI is matched exactly later, except for the port of a loopback one.

grant_typesstring[]

Optional. When sent it must include authorization_code; other values are ignored. The client is registered for authorization_code and refresh_token.

response_typesstring[]

Optional. When sent it must include code.

token_endpoint_auth_methodstring

Ignored. Every agent client is a public client (none) and PKCE protects its code.

Response

The registered client

client_idstring required

Starts with agc_.

client_id_issued_atinteger required

Unix time of the registration.

client_namestring required
redirect_urisstring[] required

The registered URIs, normalized.

token_endpoint_auth_method'none' required
grant_typesstring[] required
response_typesstring[] required

Example response

{
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": [
    "code"
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.