oauth2-server

Dynamic Client Registration

Dynamic Client Registration (DCR) for MCP clients.

Public endpoint for MCP clients to register themselves automatically. No authentication required - this follows MCP specification for DCR.

Security controls:

  • Provider whitelist: chatgpt, claude, cursor by redirect hostname; for RFC 8252 loopback redirects, a client_name naming ChatGPT, Claude, Cursor, Codex, Hermes Agent or OpenClaw (issue #1657). Every entry of redirect_uris must pass on its own (#1686)
  • IP-based rate limiting (5 registrations per minute per IP); addresses in OAUTH_DCR_RATE_LIMIT_EXEMPT_CIDRS are not limited (#1741)
  • Redirect URI pattern validation
  • Automatic token_endpoint_auth_method="none" (public clients)

Args: request: FastAPI request (for IP-based rate limiting) data: DCR request data

Returns: Created client metadata. Per RFC 7591 §3.2.1, public clients (token_endpoint_auth_method="none") do NOT receive a client_secret — the field is omitted from the JSON response via response_model_exclude (Issue #689). Clients authenticate the token endpoint using PKCE alone.

Example: POST /api/v1/oauth/register { "client_name": "ChatGPT MCP", "redirect_uris": ["https://chatgpt.com/connector_platform_oauth_redirect"], "token_endpoint_auth_method": "none" }

Spec: RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol RFC 7636 - PKCE (required for public clients) MCP Authorization Spec (2025-03-26)

post/api/v1/oauth/register

Request

  • Base URL: https://memory.kagura-ai.com (the document declares no server; this is the origin it was published from)
  • URL: https://memory.kagura-ai.com/api/v1/oauth/register
  • Auth: none declared

Request body

client_namestring

Client name

redirect_urisstring[] required

Redirect URIs

grant_typesstring[]

Grant types

response_typesstring[]

Response types

scopestring nullable

Requested scopes (space-separated)

token_endpoint_auth_methodstring

Token endpoint auth method

Response

Successful Response

client_idstring required
client_namestring required
redirect_urisstring[] required
grant_typesstring[] required
response_typesstring[] required
scopestring required
token_endpoint_auth_methodstring required
owner_idstring nullable required
providerstring required
created_atstring required
plaintext_secretstring nullable
is_visibleboolean required
visibility_expires_atstring nullable
client_secretstring nullable

Changes

No recorded changes to this operation across all 1 revision of this API.