MCP OAuth

Register an MCP client (RFC 7591)

Dynamic client registration. Public and unauthenticated by protocol — any MCP client may register itself, which is why every field is length- and count-bounded and every redirect URI is scheme-checked. The response is the only time client_secret is ever returned; it is stored hashed and cannot be read back. Omitting token_endpoint_auth_method (or sending none) registers a public client that authenticates with PKCE alone, which is how every native MCP client works. Registration grants nothing on its own: a registered client can only act after a user approves it at GET /oauth/authorize. Rate limited per client IP.

post/oauth/register

Request

  • Base URL: https://api.elaichi.ai
  • URL: https://api.elaichi.ai/oauth/register
  • Auth: none required

Request body

client_namestring

Shown on the consent screen. Defaults to "MCP client". Not verified — see client_name on the grant schema.

redirect_urisstring[] required

Where authorization codes may be delivered, matched later by exact string. Accepted: any https URI; http only on loopback (localhost, 127.0.0.1, [::1]), the RFC 8252 native-app pattern; or a private-use reverse-DNS scheme such as com.example.app:/callback. Fragments and wildcards are rejected.

grant_typesstring[]

Defaults to both. Any other value is rejected.

response_typesstring[]

Only ["code"] is supported.

token_endpoint_auth_method'none' | 'client_secret_post' | 'client_secret_basic'

Defaults to none (public client, PKCE only). Choosing either client_secret_* method issues a secret that the token and revocation endpoints will then require.

client_uristring
logo_uristring

Rendered on the consent screen beside the app name, https: only — an http:, data: or blob: value falls back to a generated monogram, as does one that fails to load. It is fetched with referrer-policy: no-referrer and without credentials. Note that it proves nothing: registration is unauthenticated, so this is a mark the registrant chose, exactly like client_name, and the consent screen says so to the user. redirect_uris remains the only identity signal a lookalike cannot forge.

scopestring

Accepted and ignored; scopes are chosen per authorization.

Response

Client registered

client_idstring

OAuth client id (ocli_…).

client_secretstring

Present only for confidential clients. Returned exactly once — store it now.

client_id_issued_atinteger

Unix seconds.

client_secret_expires_atinteger

0 — the secret does not expire.

client_namestring
redirect_urisstring[]
grant_typesstring[]
response_typesstring[]
token_endpoint_auth_methodstring
client_uristring
logo_uristring
scopestring

Space-delimited list of every scope this server supports.

Changes

No recorded changes to this operation across all 1 revision of this API.