---
title: "Register OAuth client (admin)"
method: POST
path: "/admin/oauth/clients"
tags: ["admin", "oauth-server"]
---

# Register OAuth client (admin)

`POST /admin/oauth/clients`

Manually register a new OAuth client (admin endpoint). Only available when OAuth server is enabled.

## Request body

- object
  - `client_name` string, required
  - `client_uri` string, uri
  - `redirect_uris` string[], required
  - `grant_types` string[]
  - `response_types` string[]
  - `scope` string

## Response `201`

OAuth client created

- OAuthClientSchema — Represents an OAuth 2.1 client
  - `client_id` string — Unique client identifier
  - `client_name` string — Human-readable name of the client application
  - `client_secret` string — Client secret for confidential clients (only returned on registration/regeneration)
  - `client_type` 'public' | 'confidential' — Type of the client
  - `token_endpoint_auth_method` 'none' | 'client_secret_basic' | 'client_secret_post' — Authentication method for the token endpoint
  - `registration_type` 'dynamic' | 'manual' — Registration type of the client
  - `client_uri` string, uri — URL of the client application's homepage
  - `redirect_uris` string[] — Array of redirect URIs used by the client
  - `grant_types` string[] — OAuth grant types the client is authorized to use
  - `response_types` string[] — OAuth response types the client can use
  - `scope` string — Space-separated list of scope values
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).
- `401` — HTTP Unauthorized response.
- `403` — HTTP Forbidden response.

## Changes

- **2025-09-22** `f782805361ed` — 1 info
  - endpoint added
- **2023-02-01** `144a34ca6d74` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/admin/oauth/clients/post.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/revisions/f782805361ed/schema)