---
title: "RFC 7591 dynamic client registration"
method: POST
path: "/api/oauth2/register"
tags: ["OAuth"]
---

# RFC 7591 dynamic client registration

`POST /api/oauth2/register`

## Request

- Base URL: `https://saltapp.ai`
- URL: `https://saltapp.ai/api/oauth2/register`
- Auth: none required

Public, unauthenticated -- that is the point of DCR. token_endpoint_auth_method is "none" (a public client, PKCE required), "client_secret_basic" or "client_secret_post" (a confidential client: the response carries a client_secret, shown once and never again). client_name may not impersonate Salt or use a reserved name.

## Request body

- object
  - `client_name` string, required
  - `redirect_uris` string[], required
  - `grant_types` string[]
  - `response_types` string[]
  - `token_endpoint_auth_method` 'none' | 'client_secret_basic' | 'client_secret_post'
  - `client_uri` string

## Response `201`

OK.

- object
  - `client_id` string
  - `client_name` string
  - `redirect_uris` string[]
  - `grant_types` string[]
  - `response_types` string[]
  - `token_endpoint_auth_method` string
  - `client_id_issued_at` integer
  - `client_secret` string: ocs_-prefixed. Only for a confidential client, only in this response.
  - `client_secret_expires_at` 0

## Other responses

- `400`: invalid_client_metadata.

---

[API](https://skmtc.dev/saltapp/apis/salt-agent-api.md) · [All operations](https://skmtc.dev/saltapp/apis/salt-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saltapp/apis/salt-agent-api/revisions/a8b8642ab7f8?raw)