---
title: "Dcr Public Proxy"
method: POST
path: "/auth/dcr"
---

# Dcr Public Proxy

`POST /auth/dcr`

## Request

- Base URL: `https://mcp.sentinelx.app` (the document declares no server; this is the origin it was published from)
- URL: `https://mcp.sentinelx.app/auth/dcr`
- Auth: none declared

DCR proxy that forces PUBLIC clients for loopback/desktop redirects.

Keycloak's Dynamic Client Registration defaults new clients to confidential
(client_secret_basic). Desktop MCP clients (VS Code, Android Studio, Cursor)
use loopback redirects + PKCE, and some (Android Studio) mishandle
confidential+PKCE, breaking the token exchange. For loopback redirects we
set token_endpoint_auth_method=none (public). Web clients (claude.ai,
chatgpt.com) are forwarded untouched — they register confidential and work.
nginx routes Keycloak's public registration endpoint here; we forward to
Keycloak's internal endpoint to avoid looping through that same intercept.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/sentinelx/apis/sentinelx-hub.md) · [All operations](https://skmtc.dev/sentinelx/apis/sentinelx-hub/llms.txt) · [OpenAPI document](https://skmtc.dev/sentinelx/apis/sentinelx-hub/revisions/d1f84924795e?raw)