Sign in
OAuth Clients

Register OAuth client (anonymous DCR)

Register a public OAuth client anonymously (RFC 7591 subset, §4.2).

Returns 201 with the new client_id, or 200 with the existing row's client_id on an exact (software_id + redirect-URI set) dedupe match (D8). No client_secret is ever issued here and no registration_access_token is returned (D12). New rows await admin approval unless the deployment auto-approves registrations (D9). The server.mcp.oauth.enabled gate lives on the route class — a disabled door 404s before this handler, its body validation, or the rate limiter ever run.

post/oauth-clients

Request body

application_typestring nullable

Accepted and echoed ('native' for desktop/CLI apps, per the 2026-07-28 MCP spec revision); localhost http redirect URIs are allowed regardless.

client_namestring required
grant_typesstring[] nullable

Subset of ['authorization_code', 'refresh_token'].

redirect_urisstring[] required
response_typesstring[] nullable

Only ['code'] is supported.

scopestring nullable
software_idstring nullable
software_versionstring nullable
token_endpoint_auth_methodstring nullable

Must be 'none' if supplied — this endpoint only registers public (secret-less, PKCE-only) clients.

Response

Successful Response

application_typestring nullable
client_idstring required
client_id_issued_atinteger required

Seconds since the Unix epoch at which the client_id was issued.

client_namestring required
grant_typesstring[]
redirect_urisstring[] required
response_typesstring[]
scopestring required

Space-separated scope ceiling granted to the client (the request's scope capped to the MCP tool-scope set).

software_idstring nullable
software_versionstring nullable
token_endpoint_auth_methodstring

Changes