---
title: "Dynamic Client Registration (RFC 7591)"
method: POST
path: "/oauth/register"
tags: ["oauth"]
---

# Dynamic Client Registration (RFC 7591)

`POST /oauth/register`

## Request

- Base URL: `https://docs-api.formify.eu/v1`
- URL: `https://docs-api.formify.eu/v1/oauth/register`
- Auth: none required

Register an OAuth 2.0 client programmatically. Returns a `client_id` (GUID) and, for confidential clients, a `client_secret`.

### Public vs. confidential clients
- **Public clients** (`token_endpoint_auth_method: "none"`): Must use PKCE (S256) for all authorization requests. No `client_secret` is issued.
- **Confidential clients** (`token_endpoint_auth_method: "client_secret_basic"`): Receive a `client_secret` for HTTP Basic authentication. The secret is only returned once at registration time.

### Rate limiting
This endpoint is rate limited. Exceeding the limit returns `429 Too Many Requests`.

See the [OAuth for AI & Third-Party Clients](/guides/oauth-for-ai/#option-b-dynamic-client-registration) guide for full details.

## Request body

- object
  - `client_name` string, required: Human-readable name shown to users during authorization.
  - `redirect_uris` string[], required: Array of allowed callback URLs. Must be absolute HTTPS URLs without fragments.
  - `token_endpoint_auth_method` 'none' | 'client_secret_basic': `"none"` for public clients, `"client_secret_basic"` for confidential clients.
  - `grant_types` string[]: Informational. Array of grant types the client intends to use.
  - `response_types` string[]: Array of response types. Only `"code"` is supported.
  - `client_uri` string: URL to the application's homepage.
  - `logo_uri` string: URL to the application's logo, displayed during authorization consent.
  - `tos_uri` string: Link to Terms of Service.
  - `policy_uri` string: Link to Privacy Policy.
  - `scope` string: Space-separated list of scopes the client intends to request.
  - `contacts` string[]: Array of contact email addresses.

## Response `201`

Client registered successfully.

- object
  - `client_id` string: The registered client identifier (GUID).
  - `client_name` string: The registered client name.
  - `redirect_uris` string[]: The registered redirect URIs.
  - `grant_types` string[]: The registered grant types.
  - `response_types` string[]: The registered response types.
  - `token_endpoint_auth_method` string: `"none"` or `"client_secret_basic"`.
  - `client_id_issued_at` integer: Unix timestamp when the client was registered.
  - `client_secret` string: Only for confidential clients. The client secret.
  - `client_secret_expires_at` integer: Only for confidential clients. `0` means no expiration.

## Other responses

- `400`: Invalid request — validation failed.
- `429`: Rate limit exceeded.
- `500`: Internal server error.

---

[API](https://skmtc.dev/formify/apis/formify-api.md) · [All operations](https://skmtc.dev/formify/apis/formify-api/llms.txt) · [OpenAPI document](https://skmtc.dev/formify/apis/formify-api/revisions/571c4c0d4f4f?raw)