---
title: "Dynamic Client Registration"
method: POST
path: "/api/v1/oauth/register"
tags: ["oauth2-server"]
---

# Dynamic Client Registration

`POST /api/v1/oauth/register`

## Request

- Base URL: `https://memory.kagura-ai.com` (the document declares no server; this is the origin it was published from)
- URL: `https://memory.kagura-ai.com/api/v1/oauth/register`
- Auth: none declared

Dynamic Client Registration (DCR) for MCP clients.

Public endpoint for MCP clients to register themselves automatically.
No authentication required - this follows MCP specification for DCR.

Security controls:
- Provider whitelist: chatgpt, claude, cursor by redirect hostname; for
  RFC 8252 loopback redirects, a ``client_name`` naming ChatGPT, Claude,
  Cursor, Codex, Hermes Agent or OpenClaw (issue #1657). Every entry of
  ``redirect_uris`` must pass on its own (#1686)
- IP-based rate limiting (5 registrations per minute per IP); addresses in
  ``OAUTH_DCR_RATE_LIMIT_EXEMPT_CIDRS`` are not limited (#1741)
- Redirect URI pattern validation
- Automatic token_endpoint_auth_method="none" (public clients)

Args:
    request: FastAPI request (for IP-based rate limiting)
    data: DCR request data

Returns:
    Created client metadata. Per RFC 7591 §3.2.1, public clients
    (``token_endpoint_auth_method="none"``) do NOT receive a
    ``client_secret`` — the field is omitted from the JSON response
    via ``response_model_exclude`` (Issue #689). Clients authenticate
    the token endpoint using PKCE alone.

Example:
    POST /api/v1/oauth/register
    {
      "client_name": "ChatGPT MCP",
      "redirect_uris": ["https://chatgpt.com/connector_platform_oauth_redirect"],
      "token_endpoint_auth_method": "none"
    }

Spec:
    RFC 7591 - OAuth 2.0 Dynamic Client Registration Protocol
    RFC 7636 - PKCE (required for public clients)
    MCP Authorization Spec (2025-03-26)

## Request body

- DynamicClientRegistrationRequest: Dynamic Client Registration (DCR) request for MCP clients. Simplified schema for MCP client OAuth registration (ChatGPT, Claude, Cursor, and loopback-only native clients such as Codex CLI). MCP clients use this for automatic registration.
  - `client_name` string: Client name
  - `redirect_uris` string[], required: Redirect URIs
  - `grant_types` string[]: Grant types
  - `response_types` string[]: Response types
  - `scope` string, nullable: Requested scopes (space-separated)
  - `token_endpoint_auth_method` string: Token endpoint auth method

## Response `201`

Successful Response

- OAuth2ClientWithSecretResponse: OAuth2 Client response with client secret (only on creation). ``client_secret`` is ``None`` for public clients (``token_endpoint_auth_method="none"``) per RFC 7591 §3.2.1, which forbids issuing a secret to clients that won't authenticate at the token endpoint. Confidential clients always receive a value.
  - `client_id` string, required
  - `client_name` string, required
  - `redirect_uris` string[], required
  - `grant_types` string[], required
  - `response_types` string[], required
  - `scope` string, required
  - `token_endpoint_auth_method` string, required
  - `owner_id` string, nullable, required
  - `provider` string, required
  - `created_at` string, required
  - `plaintext_secret` string, nullable
  - `is_visible` boolean, required
  - `visibility_expires_at` string, nullable
  - `client_secret` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud.md) · [All operations](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/revisions/09f17f5ada29?raw)