---
title: "Register an OAuth client (RFC 7591)"
method: POST
path: "/api/oauth/register"
tags: ["auth"]
---

# Register an OAuth client (RFC 7591)

`POST /api/oauth/register`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/oauth/register`
- Auth: none required

Anonymous, per-IP rate limited (20/hr, fails closed). Public clients only: token_endpoint_auth_method must be absent or none and no secret is issued. redirect_uris must be https, or http on 127.0.0.1 / localhost / [::1] (matched port-agnostically at authorize time). Unknown metadata is ignored and not stored. 404 unless the deployment sets OAUTH_CODE_FLOW_ENABLED=true.

## Request body

- OAuthClientRegistration: RFC 7591 client metadata. Fields other than these are ignored.
  - `redirect_uris` string[], required
  - `client_name` string: Shown to the member as unverified. Control characters stripped; max 80.
  - `token_endpoint_auth_method` 'none'
  - `grant_types` string[]
  - `response_types` string[]

## Response `201`

Client registered.

- OAuthClientResponse
  - `client_id` string, required: oac_...
  - `client_id_issued_at` integer: Unix seconds.
  - `client_name` string
  - `redirect_uris` string[], required
  - `grant_types` string[]
  - `response_types` string[]
  - `token_endpoint_auth_method` 'none', required

## Other responses

- `400`: invalid_redirect_uri or invalid_client_metadata.
- `429`: Per-IP registration limit reached.
- `503`: Rate limiter unavailable; registration paused.

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)