---
title: "Register an OAuth client (Dynamic Client Registration)"
method: POST
path: "/oauth/register"
tags: ["Authentication"]
---

# Register an OAuth client (Dynamic Client Registration)

`POST /oauth/register`

## Request

- Base URL: `https://riskmodels.app/api`
- URL: `https://riskmodels.app/api/oauth/register`
- Auth: none required

RFC 7591 dynamic client registration. MCP clients self-register here after discovering the authorization server at `/.well-known/oauth-authorization-server`.

Public clients only: no `client_secret` is issued and `token_endpoint_auth_method` is `none` — the authorization code grant is bound to the client by PKCE instead. `redirect_uris` must be absolute; `http://` is accepted only for loopback hosts (RFC 8252).

Rate limited to 30 registrations per IP per hour.

## Request body

- OAuthClientRegistrationRequest
  - `redirect_uris` string[], required: Absolute redirect URIs. `https://` and custom (native app) schemes are accepted; `http://` only for loopback hosts (`localhost`, `127.0.0.1`, `::1`).
  - `client_name` string

## Response `201`

Client registered

- OAuthClientRegistrationResponse
  - `client_id` string, uuid
  - `client_id_issued_at` integer: Unix timestamp (seconds).
  - `redirect_uris` string[]
  - `grant_types` string[]
  - `response_types` string[]
  - `token_endpoint_auth_method` 'none': Public client — no client_secret is issued; PKCE binds the grant.
  - `client_name` string: Present only if supplied at registration.

## Other responses

- `400`: `invalid_client_metadata` (body is not JSON) or `invalid_redirect_uri` (`redirect_uris` missing, empty, non-absolute, or a non-loopback `http://` URI).
- `429`: Registration rate limit exceeded
- `500`: server_error — client record could not be persisted

---

[API](https://skmtc.dev/riskmodels/apis/riskmodels-api.md) · [All operations](https://skmtc.dev/riskmodels/apis/riskmodels-api/llms.txt) · [OpenAPI document](https://skmtc.dev/riskmodels/apis/riskmodels-api/revisions/1a034cad408a?raw)