PYpydantic
OAuth

Dynamic Client Registration (RFC 7591)

RFC 7591: Dynamic Client Registration.

Allows MCP clients and other OAuth clients to register themselves without prior manual setup. Creates a public OAuth client (token_endpoint_auth_method: "none") with no organization binding. The organization is determined later when the user authorizes.

This endpoint is unauthenticated per the MCP/OAuth specification.

Security considerations (RFC 7591 Section 5):

  • DCR clients are public (no secret); security relies on PKCE (S256), redirect_uri validation, and the user's explicit consent on the authorization page.
  • Requested scopes are limited to the user-delegable OAuth catalog, then narrowed by resource metadata, the user's permissions, and explicit consent.
  • Rate limiting is enforced per IP (60/min, 600/hour) to prevent resource exhaustion.
  • Client IDs use lf_dcr_ prefix for easy identification and auditing.
post/oauth/register

Request

Headers

user-agentstring nullable

Request body

client_namestring
client_uristring nullable
logo_uristring nullable
redirect_urisstring[]
grant_typesstring[]
response_typesstring[]
token_endpoint_auth_methodstring
scopestring
application_typestring
require_pushed_authorization_requestsunknown

Response

Successful Response

client_idstring required
client_id_issued_atinteger required
client_namestring required
client_uristring nullable
logo_uristring nullable
redirect_urisstring[] required
grant_typesstring[] required
response_typesstring[] required
token_endpoint_auth_methodstring required
scopestring required
application_typestring required
require_pushed_authorization_requestsboolean
registration_client_uristring required
registration_access_tokenstring required

Changes

No recorded changes to this operation across all 1 revision of this API.