---
title: "Dynamic client registration (RFC 7591)"
method: POST
path: "/register"
tags: ["Identity Provider"]
---

# Dynamic client registration (RFC 7591)

`POST /register`

## Request

- Base URL: `https://id.deadsimple.email`
- URL: `https://id.deadsimple.email/register`
- Auth: HTTP bearer

Registers a relying party that may request `owner_email`, `org` and `offline_access`. Unlike the MCP OAuth server's /oauth/register, this endpoint requires a Dead Simple API key (`Authorization: Bearer dse_...`) with the api_keys.create permission: trial keys from agent self-signup and MCP OAuth tokens are refused, so an anonymous party cannot mint a client that sees owner data. The client_secret is shown once. The same registration with the standard API envelope is available at POST /v1/identity/clients.

## Request body

- IdentityClientRegistration
  - `client_name` string
  - `client_uri` string
  - `logo_uri` string
  - `policy_uri` string
  - `tos_uri` string
  - `redirect_uris` string[], required: https, loopback http, or app-scheme URLs.
  - `scope` string: Any of openid, email, profile, owner_email, org, offline_access. openid is always included.
  - `token_endpoint_auth_method` 'none' | 'client_secret_basic' | 'client_secret_post'

## Response `201`

client_id (dse_idc_) and, unless token_endpoint_auth_method is none, client_secret (dse_ics_).

- IdentityClientCreated
  - `client_id` string
  - `client_name` string
  - `client_uri` string
  - `logo_uri` string
  - `redirect_uris` string[]
  - `token_endpoint_auth_method` 'none' | 'client_secret_basic' | 'client_secret_post'
  - `scope` string: Space-separated scopes the client may request.
  - `grant_types` string[]
  - `response_types` string[]
  - `created_at` string, date-time
  - `client_secret` string: dse_ics_ secret. Shown once; stored hashed. Absent when token_endpoint_auth_method is none.
  - `client_secret_expires_at` integer: 0 means the secret does not expire.
  - `client_id_issued_at` integer
  - `warning` string
  - `issuer` string
  - `discovery_url` string

## Other responses

- `400`: invalid_client_metadata.
- `401`: No API key.
- `403`: Key lacks api_keys.create (trial keys), or an MCP OAuth token was used.

---

[API](https://skmtc.dev/deadsimple/apis/dead-simple-email-api.md) · [All operations](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/llms.txt) · [OpenAPI document](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/revisions/c697881be131?raw)