---
title: "Oauth Register"
method: POST
path: "/oauth/register"
tags: ["oauth"]
---

# Oauth Register

`POST /oauth/register`

## Request

- Base URL: `https://api.slideforge.dev`
- URL: `https://api.slideforge.dev/oauth/register`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

RFC 7591 - Dynamic Client Registration.

Redirect URIs are validated to prevent open-redirect attacks:
- HTTPS, loopback HTTP, or a private-use native-app scheme (RFC 8252 §7.1:
  cursor://, windsurf://, ...). Plain http:// to a real host stays rejected
  (cleartext), as do browser-executable schemes. PKCE — S256, enforced
  unconditionally at /oauth/authorize — is what makes custom schemes safe:
  an app that hijacks the scheme catches the code but cannot exchange it
  without the verifier. ADR-2026-08-16-dcr-custom-scheme-redirects.

Cap of 100 registered clients enforced via LRU eviction (oldest by
last_used_at) — friendlier than 503 for legitimate clients while
bounding storage growth.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/slideforge/apis/slideforge-api.md) · [All operations](https://skmtc.dev/slideforge/apis/slideforge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/slideforge/apis/slideforge-api/revisions/ae698e3d3c00?raw)