---
title: "Register a client"
method: POST
path: "/oauth/register"
tags: ["OAuth"]
---

# Register a client

`POST /oauth/register`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/oauth/register`
- Auth: HTTP bearer

RFC 7591 dynamic registration, unauthenticated by necessity: a stranger's assistant cannot
connect if registration requires a credential it does not yet have.

A `client_id` is an identifier and never an authorisation. It grants nothing until a human
approves a consent screen, so the only things enforced here are the ones that protect that
screen and the redirect: an acceptable `redirect_uri` (https, or http on a loopback address
per RFC 8252, and no fragment), a display name that cannot lie (control characters stripped,
length capped), and a per-address rate limit so the table cannot be grown without bound.

No client secret is issued. Requests asking for one, or for an unsupported grant, are refused
here rather than silently downgraded.

## Request body

- object
  - `redirect_uris` string[], required
  - `client_name` string
  - `client_uri` string, uri
  - `logo_uri` string, uri
  - `policy_uri` string, uri
  - `tos_uri` string, uri
  - `software_id` string
  - `grant_types` string[]
  - `response_types` string[]
  - `token_endpoint_auth_method` 'none'

## Response `201`

The issued client identifier.

- object
  - `client_id` string, required
  - `client_name` string
  - `client_id_issued_at` integer
  - `redirect_uris` string[]
  - `grant_types` string[]
  - `response_types` string[]
  - `token_endpoint_auth_method` string
  - `scope` string

## Other responses

- `400`: RFC 6749 §5.2 error object. Every authorization-code failure — unknown code, wrong client, mismatched redirect, expired, replayed — answers the same `invalid_grant`, because distinguishing them tells an attacker which half of a guess was right.
- `429`: RFC 6749 §5.2 error object. Every authorization-code failure — unknown code, wrong client, mismatched redirect, expired, replayed — answers the same `invalid_grant`, because distinguishing them tells an attacker which half of a guess was right.

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)