---
title: "OAuth 2.0 Dynamic Client Registration (RFC 7591)"
method: POST
path: "/oauth/register"
tags: ["OAuth"]
---

# OAuth 2.0 Dynamic Client Registration (RFC 7591)

`POST /oauth/register`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/oauth/register`
- Auth: none required

Registers a public OAuth client for the MCP flow. No client secret is issued (PKCE-protected public clients only). redirect_uris must be HTTPS, or an RFC 8252 loopback (http://127.0.0.1[:port]/..., http://[::1][:port]/..., or http://localhost[:port]/...), and are exact-matched at /authorize. Registration needs no manual step (RFC 7591), but an HTTPS redirect_uri is admitted only when its hostname exactly matches Mnemom's reviewed MCP-host allowlist (for example chatgpt.com, claude.ai and vscode.dev), on the default port, with no wildcard or prefix matching; any other host is rejected with invalid_redirect_uri here, and /authorize refuses it again (an error page, never a redirect). Loopback redirect_uris are accepted on any port. A device-only client (no redirect_uris) completes the flow but is issued a token with no capability unless its client_id is explicitly vetted by an operator, and its consent screen says so. Contact Mnemom to have an additional client host reviewed and added. Registration is abuse-guarded with per-IP and global daily caps.

## Request body

- object
  - `client_name` string, required
  - `redirect_uris` string[]
  - `grant_types` string[]: Requested grant types. A client requesting ONLY urn:ietf:params:oauth:grant-type:device_code (RFC 8628 device flow) may omit redirect_uris; any authorization_code client must supply at least one redirect_uri.
  - `token_endpoint_auth_method` 'none'
  - `response_types` string[]

## Response `201`

Client registered (RFC 7591 §3.2.1 client information response).

- object
  - `client_id` string, required
  - `client_name` string
  - `redirect_uris` string[], required
  - `token_endpoint_auth_method` 'none'
  - `grant_types` string[]
  - `response_types` string[]
  - `client_id_issued_at` integer

## Other responses

- `400`: Invalid client metadata or redirect_uri (`invalid_redirect_uri`: not HTTPS/loopback, or an HTTPS host that is not approved for dynamic registration).
- `403`: Cross-origin write refused (`cross_origin_rejected`). A state-changing request that carries the browser session cookie must come from a first-party origin (`Origin`, or failing that `Referer`) and must not send a form-style body (text/plain, urlencoded, multipart) the operation does not declare. Bearer and API-key callers are never subject to this check.
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)