Internal OAuth
Internal OAuth

Get Client For Consent

Resolve a client so the consent page can name who is asking.

The consent page only ever sees a client_id in its query string, so the name and redirect must be resolved here, server-side, against the row we actually registered — anything carried in the URL is attacker-supplied.

trusted is computed from the redirect HOST, never from client_name: /register is open (MCP spec) and stores whatever name the caller sends, so an attacker can register as "Claude". See OAUTH_CONFIG.

get/api/internal/oauth/client/{client_id}

Request

  • Base URL: https://api.thebetterhire.ai (the document declares no server; this is the origin it was published from)
  • URL: https://api.thebetterhire.ai/api/internal/oauth/client/{client_id}
  • Auth: none declared

Path parameters

client_idstring required

Response

Successful Response

unknown required

Changes

No recorded changes to this operation across all 1 revision of this API.