Register Client

Let an assistant introduce itself.

This grants nothing. A row here is a name and a list of addresses a code may be returned to; every authorization still goes through a person who is signed in to Admiral and choosing an account. The reason to check anything at all is the redirect URIs, because those are the one field that can send somebody else's code somewhere it should not go.

RFC 7591 requires this to be open, and it is — but it was the only public endpoint in the app with no rate limit, and every accepted POST inserts a row. "Grants nothing" is about authority, not about cost: an unbounded writer against a table is still a way to fill a database. The limit is generous, because a real assistant registers once per deployment and a developer testing an integration may legitimately do it a few dozen times in an afternoon.