---
title: "Dynamic client registration (RFC 7591)"
method: POST
path: "/oauth/register"
tags: ["OAuth"]
---

# Dynamic client registration (RFC 7591)

`POST /oauth/register`

## Request

- Base URL: `https://api.infolang.ai`
- URL: `https://api.infolang.ai/oauth/register`
- Auth: none declared

Register an OAuth client and receive a `client_id`. MCP clients rely on this: there is no human to fill in a registration form on a developer portal, so registration is open. That is safe because a `client_id` confers nothing on its own — it cannot be exchanged for a token without a human completing consent.

`redirect_uris` must be `https`, or `http` on a loopback host (`localhost`, `127.0.0.0/8`, `[::1]`) for a native client per RFC 8252 §7.3. Wildcards and fragments are rejected. A `client_secret` is issued only when `token_endpoint_auth_method` is not `none`, and is returned exactly once. Public — no credential. That is not an oversight: a client cannot authenticate before it has a token, which is the entire purpose of this surface.

## Request body

- object
  - `redirect_uris` string[]
  - `client_name` string
  - `grant_types` string[]
  - `response_types` string[]
  - `token_endpoint_auth_method` 'none' | 'client_secret_post' | 'client_secret_basic'
  - `scope` string
  - `software_id` string
  - `software_version` string

## Response `201`

The registered client (the secret, if any, appears only here)

- object
  - `client_id` string, required
  - `client_secret` string
  - `client_id_issued_at` number, required
  - `redirect_uris` string[], required

## Other responses

- `400`: `invalid_client_metadata` or `invalid_redirect_uri`

---

[API](https://skmtc.dev/infolang/apis/infolang-api.md) · [All operations](https://skmtc.dev/infolang/apis/infolang-api/llms.txt) · [OpenAPI document](https://skmtc.dev/infolang/apis/infolang-api/revisions/d04bf6de72c8?raw)