OAuth

Dynamic Client Registration

RFC 7591 Dynamic Client Registration. One unauthenticated endpoint that lets any compliant OAuth/MCP client self-register and receive its own client_id, so AI chatbots (ChatGPT, Claude, Cursor, …) onboard with zero manual configuration.

Registration alone grants no data access: a registered client can only reach resources after a Purple Grain user completes the interactive GET /oauth/authorize login + consent (PKCE is enforced). Most clients should register as public (token_endpoint_auth_method=none).

post/oauth/register

Request

  • Base URL: https://api.purplegrain.com
  • URL: https://api.purplegrain.com/oauth/register
  • Auth: none declared

Request body

client_namestring

Human-readable client name. Defaults to "MCP client" when omitted.

redirect_urisstring[] required

Redirect URIs (max 5). Each must be https, an RFC 8252 loopback http URI (localhost / 127.0.0.1 / ::1), or a native private-use scheme (e.g. com.example.app:/cb). Plain http on a remote host is rejected.

token_endpoint_auth_method'none' | 'client_secret_basic' | 'client_secret_post'

none registers a public client (PKCE, no secret) — the default and the norm for MCP clients. Any other value registers a confidential client and a client_secret is returned.

scopestring

Space-separated requested scopes. public, read and write are honored; unknown scopes are dropped. Defaults to public read write: an assistant connection starts with read and write where the person's role allows it, limited by the per-business grants they can narrow.

application_typestring
grant_typesstring[]
response_typesstring[]

Response

Client registered.

client_idstring
client_id_issued_atinteger

Issuance time (seconds since the Unix epoch).

client_secretstring

Present only for confidential clients (token_endpoint_auth_method other than none).

client_secret_expires_atinteger

0 = never expires (RFC 7591). Present only for confidential clients.

redirect_urisstring[]
token_endpoint_auth_methodstring
grant_typesstring[]
response_typesstring[]
client_namestring
scopestring

Changes

No recorded changes to this operation across all 2 revisions of this API.