Authentication

Register an OAuth client (Dynamic Client Registration)

RFC 7591 dynamic client registration. MCP clients self-register here after discovering the authorization server at /.well-known/oauth-authorization-server.

Public clients only: no client_secret is issued and token_endpoint_auth_method is none — the authorization code grant is bound to the client by PKCE instead. redirect_uris must be absolute; http:// is accepted only for loopback hosts (RFC 8252).

Rate limited to 30 registrations per IP per hour.

post/oauth/register

Request

  • Base URL: https://riskmodels.app/api
  • URL: https://riskmodels.app/api/oauth/register
  • Auth: none required

Request body

redirect_urisstring[] required

Absolute redirect URIs. https:// and custom (native app) schemes are accepted; http:// only for loopback hosts (localhost, 127.0.0.1, ::1).

client_namestring

Example request

{
  "redirect_uris": [
    "https://claude.ai/api/mcp/auth_callback"
  ],
  "client_name": "Claude Desktop"
}

Response

Client registered

client_idstring uuid
client_id_issued_atinteger

Unix timestamp (seconds).

redirect_urisstring[]
grant_typesstring[]
response_typesstring[]
token_endpoint_auth_method'none'

Public client — no client_secret is issued; PKCE binds the grant.

client_namestring

Present only if supplied at registration.

Example response

{
  "client_id": "3f8a1c2e-5b47-4d90-9e21-7c6b0a4d8f13",
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": [
    "code"
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.