---
title: "RFC 7591 Dynamic Client Registration — public, self-serve."
method: POST
path: "/api/v1/oauth/register"
tags: ["oauth"]
---

# RFC 7591 Dynamic Client Registration — public, self-serve.

`POST /api/v1/oauth/register`

## Request

- Base URL: `https://erp.eyeot.fr/api/v1`
- URL: `https://erp.eyeot.fr/api/v1/api/v1/oauth/register`
- Auth: none declared

RFC 7591 Dynamic Client Registration — public, self-serve.

    A remote MCP client (claude.ai / ChatGPT « custom connector ») POSTs its
    metadata (``redirect_uris``, ``grant_types``, ``token_endpoint_auth_method``,
    ``client_name``, ``scope``) and receives a ``client_id`` (+ ``client_secret``
    for confidential clients). It then runs the standard Authorization Code +
    PKCE flow.

    Guard-rails (see ``oauth_service.register_dynamic_client``) :
    - Public clients keep PKCE S256 mandatory (enforced at code issuance).
    - ``admin`` scope is NOT grantable via DCR (read/write/openid/profile only).
    - Rate-limited (10/hour/IP) + global cap of self-registered clients.

    Errors follow the RFC 6749 §5.2-style shape
    (``{"error": "invalid_redirect_uri", "error_description": …}``) via
    ``@oauth_rfc6749_errors`` — that's what RFC 7591 §3.2.2 clients expect.

## Response `200`

Succès — payload `{data, meta}` (cf. API-GUIDE §3.1)

## Other responses

- `201`: Ressource créée. ID dans `data.id`.
- `400`: Validation Marshmallow échouée. `errors` détaille chaque champ invalide.
- `404`: Ressource introuvable (ou cross-tenant — équivalent à hidden).
- `409`: État incohérent (email dupliqué, ressource déjà dans cet état, etc.).
- `422`: Validation Marshmallow échouée. `errors` détaille chaque champ invalide.
- `429`: Trop de requêtes. Honorer le header `Retry-After` (secondes).

---

[API](https://skmtc.dev/eyeot/apis/eyeot-erp-api.md) · [All operations](https://skmtc.dev/eyeot/apis/eyeot-erp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyeot/apis/eyeot-erp-api/revisions/42ab95222a89?raw)