---
title: "Dynamically register an MCP OAuth client"
method: POST
path: "/credits/mcp/oauth/register"
tags: ["MCP"]
---

# Dynamically register an MCP OAuth client

`POST /credits/mcp/oauth/register`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/mcp/oauth/register`
- Auth: none required

RFC 7591 registration for public native or web clients. Register authorization_code with validated redirect URIs, the RFC 8628 device-code grant without redirect URIs, or both. refresh_token is optional; offline_access is grantable only when it is registered.

## Request body

- union
  - object
    - `grant_types` string[], required: Must contain authorization_code or the device-code grant. refresh_token may accompany either.
    - `client_name` string
    - `application_type` 'native' | 'web'
    - `redirect_uris` string[]: Required and non-empty when grant_types contains authorization_code; may be empty for a device-only client.
    - `response_types` string[]: Exactly ["code"] for authorization_code clients and [] for device-only clients.
    - `token_endpoint_auth_method` 'none'
    - `client_uri` string, uri
    - `logo_uri` string, uri
  - object
    - `grant_types` string[], required: Must contain authorization_code or the device-code grant. refresh_token may accompany either.
    - `client_name` string
    - `application_type` 'native' | 'web'
    - `redirect_uris` string[]: Required and non-empty when grant_types contains authorization_code; may be empty for a device-only client.
    - `response_types` string[]: Exactly ["code"] for authorization_code clients and [] for device-only clients.
    - `token_endpoint_auth_method` 'none'
    - `client_uri` string, uri
    - `logo_uri` string, uri

## Response `201`

Registered client and one-time registration access token

- union
  - object
    - `grant_types` string[], required: Must contain authorization_code or the device-code grant. refresh_token may accompany either.
    - `client_name` string, required
    - `application_type` 'native' | 'web', required
    - `redirect_uris` string[], required: Required and non-empty when grant_types contains authorization_code; may be empty for a device-only client.
    - `response_types` string[], required: Exactly ["code"] for authorization_code clients and [] for device-only clients.
    - `token_endpoint_auth_method` 'none', required
    - `client_uri` string, uri
    - `logo_uri` string, uri
    - `client_id` string, required
    - `client_id_issued_at` integer, required
    - `registration_client_uri` string, uri, required
    - `registration_access_token` string: Returned only when the client is created; show and store it once.
  - object
    - `grant_types` string[], required: Must contain authorization_code or the device-code grant. refresh_token may accompany either.
    - `client_name` string, required
    - `application_type` 'native' | 'web', required
    - `redirect_uris` string[], required: Required and non-empty when grant_types contains authorization_code; may be empty for a device-only client.
    - `response_types` string[], required: Exactly ["code"] for authorization_code clients and [] for device-only clients.
    - `token_endpoint_auth_method` 'none', required
    - `client_uri` string, uri
    - `logo_uri` string, uri
    - `client_id` string, required
    - `client_id_issued_at` integer, required
    - `registration_client_uri` string, uri, required
    - `registration_access_token` string: Returned only when the client is created; show and store it once.

## Other responses

- `400`: Invalid client metadata
- `415`: Content type must be application/json

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)