---
title: "Register an OAuth client (RFC 7591)"
method: POST
path: "/oauth/register"
tags: ["OAuth"]
---

# Register an OAuth client (RFC 7591)

`POST /oauth/register`

## Request

- Base URL: `https://api.groundmail.dev`
- URL: `https://api.groundmail.dev/oauth/register`
- Auth: none required

Dynamic client registration for MCP clients and other apps. Redirect URIs must be `https://`, loopback `http://` (`localhost`, `127.0.0.1`, `[::1]`, any port), or a private-use scheme for a native app (RFC 8252), such as `cursor://anysphere.cursor-mcp/oauth/callback`. Fragments and schemes a browser handles itself (`javascript:`, `data:`, `file:`, …) are refused. With `token_endpoint_auth_method: client_secret_post` the response includes a `client_secret`, shown once, that the client must send to `/oauth/token`.

## Request body

- OAuthClientRegistrationRequest
  - `client_name` string, required
  - `redirect_uris` string[]: Required with the authorization_code grant (the default)
  - `token_endpoint_auth_method` 'none' | 'client_secret_post'
  - `grant_types` string[]: Default `authorization_code` and `refresh_token`

## Response `201`

Client registered

- OAuthClientRegistrationResponse
  - `client_id` string, required
  - `client_secret` string: Only for `client_secret_post` clients, shown once
  - `client_id_issued_at` integer, required
  - `client_name` string, required
  - `redirect_uris` string[], required
  - `token_endpoint_auth_method` 'none' | 'client_secret_post', required
  - `grant_types` string[], required
  - `response_types` string[]

## Other responses

- `400`: `invalid_client_metadata`

---

[API](https://skmtc.dev/groundmail/apis/groundmail-api.md) · [All operations](https://skmtc.dev/groundmail/apis/groundmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/groundmail/apis/groundmail-api/revisions/479821c9fecf?raw)