Oauth Register

RFC 7591 - Dynamic Client Registration.

Redirect URIs are validated to prevent open-redirect attacks:

• HTTPS, loopback HTTP, or a private-use native-app scheme (RFC 8252 §7.1: cursor://, windsurf://, ...). Plain http:// to a real host stays rejected (cleartext), as do browser-executable schemes. PKCE — S256, enforced unconditionally at /oauth/authorize — is what makes custom schemes safe: an app that hijacks the scheme catches the code but cannot exchange it without the verifier. ADR-2026-08-16-dcr-custom-scheme-redirects.

Cap of 100 registered clients enforced via LRU eviction (oldest by last_used_at) — friendlier than 503 for legitimate clients while bounding storage growth.