---
title: "Register a public OAuth client"
method: POST
path: "/oauth/register"
tags: ["OAuth"]
---

# Register a public OAuth client

`POST /oauth/register`

## Request

- Base URL: `https://spoonjoy.app`
- URL: `https://spoonjoy.app/oauth/register`
- Auth: none required

## Request body

- OAuthRegisterRequest
  - `client_name` string: At most 80 Unicode code points. Control and bidirectional formatting characters are rejected. Dynamically registered client names are self-asserted and displayed as unverified.
  - `redirect_uris` string[], required
  - `token_endpoint_auth_method` 'none'
  - `grant_types` string[]
  - `response_types` string[]
  - `scope` string
  - `application_type` 'web' | 'native': Optional RFC 7591/OIDC application type. Omitted values default to web; valid values are echoed in the registration response.
  - `client_uri` string, uri: Accepted RFC 7591 metadata; not used by Spoonjoy.
  - `logo_uri` string, uri: Accepted RFC 7591 metadata; not used by Spoonjoy.
  - `policy_uri` string, uri: Accepted RFC 7591 metadata; not used by Spoonjoy.
  - `tos_uri` string, uri: Accepted RFC 7591 metadata; not used by Spoonjoy.
  - `contacts` string[]: Accepted RFC 7591 metadata; not used by Spoonjoy.
  - `jwks_uri` string, uri: Accepted RFC 7591 metadata; not used by Spoonjoy.
  - `jwks` object: Accepted RFC 7591 metadata; not used because Spoonjoy public clients use PKCE and no client secret.
  - `sector_identifier_uri` string, uri: Accepted OIDC metadata; not used by Spoonjoy.
  - `subject_type` string: Accepted OIDC metadata; not used by Spoonjoy.
  - `software_id` string: Accepted RFC 7591 metadata; not used by Spoonjoy.
  - `software_version` string: Accepted RFC 7591 metadata; not used by Spoonjoy.
  - `default_max_age` integer: Accepted OIDC metadata; not used by Spoonjoy.
  - `require_auth_time` boolean: Accepted OIDC metadata; not used by Spoonjoy.
  - `default_acr_values` string[]: Accepted OIDC metadata; not used by Spoonjoy.
  - `initiate_login_uri` string, uri: Accepted OIDC metadata; not used by Spoonjoy.
  - `request_uris` string[]: Accepted OIDC metadata; not used by Spoonjoy.
  - `id_token_signed_response_alg` string: Accepted OIDC metadata; not used by Spoonjoy.
  - `id_token_encrypted_response_alg` string: Accepted OIDC metadata; not used by Spoonjoy.
  - `id_token_encrypted_response_enc` string: Accepted OIDC metadata; not used by Spoonjoy.
  - `userinfo_signed_response_alg` string: Accepted OIDC metadata; not used by Spoonjoy.
  - `userinfo_encrypted_response_alg` string: Accepted OIDC metadata; not used by Spoonjoy.
  - `userinfo_encrypted_response_enc` string: Accepted OIDC metadata; not used by Spoonjoy.
  - `request_object_signing_alg` string: Accepted OIDC metadata; not used by Spoonjoy.
  - `request_object_encryption_alg` string: Accepted OIDC metadata; not used by Spoonjoy.
  - `request_object_encryption_enc` string: Accepted OIDC metadata; not used by Spoonjoy.
  - `token_endpoint_auth_signing_alg` string: Accepted RFC 7591 metadata; not used because Spoonjoy public clients use token_endpoint_auth_method: none.

## Response `201`

Registered client

- OAuthRegisterResponse
  - `client_id` string, required
  - `client_name` string
  - `redirect_uris` string[], required
  - `token_endpoint_auth_method` 'none', required
  - `grant_types` string[], required
  - `response_types` string[], required

## Other responses

- `400`: OAuth error
- `429`: Rate limited. This is the generic Spoonjoy rate-limit shape, not a standard OAuth error.

---

[API](https://skmtc.dev/spoonjoy/apis/spoonjoy-api.md) · [All operations](https://skmtc.dev/spoonjoy/apis/spoonjoy-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spoonjoy/apis/spoonjoy-api/revisions/b96eb5d4697d?raw)