Register OAuth client (DCR)

Open endpoint — no authentication required. Desktop/CLI apps call this once to obtain a client_id they persist locally and reuse for all future authorize flows.

post/public/v1/oauth/register/

Request body

client_namestring required

Human-readable name of the client application.

redirect_urisstring[] required

List of allowed redirect URIs. At least one is required. The redirect_uri used in the authorization request must exactly match one of these.

scopestring

Space-separated list of requested scopes. Available value: all. Defaults to all if omitted.

Response

client_idstring required

Unique identifier for the registered client. Persist this value — it is required for all subsequent authorization requests.

client_namestring required

Human-readable name of the client application.

redirect_urisstring[] required

Registered redirect URIs for this client.

scopestring required

Space-separated list of scopes granted to this client.

token_endpoint_auth_methodstring required

Authentication method for the token endpoint. Always none (public client, PKCE required).

grant_typesstring[] required

Supported grant types. Always [authorization_code, refresh_token].

response_typesstring[] required

Supported response types. Always [code].

client_id_issued_atinteger required

Unix timestamp of when the client_id was issued.

Changes

Changed in 1 of the 3 revisions of this API.4

Aug 18, 202687e654ac822e4See the full diff
- ○
  added the media type application/json for the response with the status 400
  response-media-type-added
- ○
  added the non-success response with the status 401
  response-non-success-status-added
- ○
  added the non-success response with the status 403
  response-non-success-status-added
- ○
  added the non-success response with the status 429
  response-non-success-status-added
This revision also has 13 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Full history