---
title: "Dynamic Client Registration (RFC 7591)"
method: POST
path: "/oauth/register"
tags: ["OAuth"]
---

# Dynamic Client Registration (RFC 7591)

`POST /oauth/register`

## Request

- Base URL: `https://logfire-api.pydantic.dev/api`
- URL: `https://logfire-api.pydantic.dev/api/oauth/register`
- Auth: none declared
- TypeScript: <https://skmtc.dev/pydantic/apis/pydantic-logfire-api/docs/oauth/register/post.ts> (a function with typed inputs; its response is checked against the schema)

RFC 7591: Dynamic Client Registration.

Allows MCP clients and other OAuth clients to register themselves
without prior manual setup.  Creates a **public** OAuth client
(`token_endpoint_auth_method: "none"`) with no organization binding.
The organization is determined later when the user authorizes.

This endpoint is unauthenticated per the MCP/OAuth specification.

Security considerations (RFC 7591 Section 5):
- DCR clients are **public** (no secret); security relies on PKCE (S256),
  redirect_uri validation, and the user's explicit consent on the authorization page.
- Requested scopes are limited to the user-delegable OAuth catalog, then narrowed by
  resource metadata, the user's permissions, and explicit consent.
- Rate limiting is enforced per IP (60/min, 600/hour) to prevent resource exhaustion.
- Client IDs use `lf_dcr_` prefix for easy identification and auditing.

## Headers

- `user-agent` string, nullable

## Request body

- DCRRequest: RFC 7591 Client Metadata for Dynamic Client Registration.
  - `client_name` string
  - `client_uri` string, nullable
  - `logo_uri` string, nullable
  - `redirect_uris` string[]
  - `grant_types` string[]
  - `response_types` string[]
  - `token_endpoint_auth_method` string
  - `scope` string
  - `application_type` string
  - `require_pushed_authorization_requests` unknown

## Response `200`

Successful Response

- DCRResponse: RFC 7591/7592 Client Information Response.
  - `client_id` string, required
  - `client_id_issued_at` integer, required
  - `client_name` string, required
  - `client_uri` string, nullable
  - `logo_uri` string, nullable
  - `redirect_uris` string[], required
  - `grant_types` string[], required
  - `response_types` string[], required
  - `token_endpoint_auth_method` string, required
  - `scope` string, required
  - `application_type` string, required
  - `require_pushed_authorization_requests` boolean
  - `registration_client_uri` string, required
  - `registration_access_token` string, required

## Other responses

- `400`: Bad Request
- `422`: Validation Error

---

[API](https://skmtc.dev/pydantic/apis/pydantic-logfire-api.md) - [All operations](https://skmtc.dev/pydantic/apis/pydantic-logfire-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pydantic/apis/pydantic-logfire-api/revisions/7996e45256f4?raw)