---
title: "Register OAuth client (anonymous DCR)"
method: POST
path: "/oauth-clients"
tags: ["OAuth Clients"]
---

# Register OAuth client (anonymous DCR)

`POST /oauth-clients`

Register a public OAuth client anonymously (RFC 7591 subset, §4.2).

Returns 201 with the new ``client_id``, or 200 with the **existing** row's
``client_id`` on an exact (``software_id`` + redirect-URI set) dedupe match
(D8). No client_secret is ever issued here and no registration_access_token
is returned (D12). New rows await admin approval unless the deployment
auto-approves registrations (D9). The ``server.mcp.oauth.enabled`` gate
lives on the route class — a disabled door 404s before this handler,
its body validation, or the rate limiter ever run.

## Request body

- OAuthClientRegistrationRequest — POST /oauth-clients request body (RFC 7591 client metadata subset).
  - `application_type` string, nullable — Accepted and echoed ('native' for desktop/CLI apps, per the 2026-07-28 MCP spec revision); localhost http redirect URIs are allowed regardless.
  - `client_name` string, required
  - `grant_types` string[], nullable — Subset of ['authorization_code', 'refresh_token'].
  - `redirect_uris` string[], required — 1-20 redirect URIs. `https` always; `http` for loopback hosts only; RFC 8252 §7.1 private-use (custom) schemes are accepted for native apps (browser-executable and other dangerous schemes are rejected).
  - `response_types` string[], nullable — Only ['code'] is supported.
  - `scope` string, nullable
  - `software_id` string, nullable
  - `software_version` string, nullable
  - `token_endpoint_auth_method` string, nullable — Must be 'none' if supplied — this endpoint only registers public (secret-less, PKCE-only) clients.

## Response `201`

Successful Response

- OAuthClientRegistrationResponse — POST /oauth-clients response (201 created, or 200 on a D8 dedupe hit). RFC 7591-compatible: ``client_id`` plus the registered metadata. No ``client_secret`` (public clients only) and no ``registration_access_token`` (D12 — no RFC 7592 self-management surface; clients retry ``/authorize``, they don't poll).
  - `application_type` string, nullable
  - `client_id` string, required
  - `client_id_issued_at` integer, required — Seconds since the Unix epoch at which the client_id was issued.
  - `client_name` string, required
  - `grant_types` string[]
  - `redirect_uris` string[], required
  - `response_types` string[]
  - `scope` string, required — Space-separated scope ceiling granted to the client (the request's scope capped to the MCP tool-scope set).
  - `software_id` string, nullable
  - `software_version` string, nullable
  - `token_endpoint_auth_method` string

## Other responses

- `400` — Invalid client metadata (RFC 7591 §3.2.2): `{"error": "invalid_client_metadata", "error_description": "..."}`.
- `500` — Internal Server Error
- `503` — Service Unavailable

## Changes

- **2026-09-01** `479c8eab7dd0` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/jentic/apis/jentic-control-plane-api/changes/oauth-clients/post.md)

---

[API](https://skmtc.dev/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.dev/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/revisions/6317149fe990/schema)