OAuth

Register an OAuth client (Dynamic Client Registration).

RFC 7591 Dynamic Client Registration. Public, unauthenticated — a hosted client (e.g. an MCP host) self-registers before any user is involved. Public clients (PKCE-only) omit token_endpoint_auth_method or set it to none and receive no secret; confidential clients set client_secret_post and receive a client_secret once. Rate-limited per IP. (Developers can also register apps interactively at Developer → OAuth Apps in the dashboard.)

post/api/oauth/register

Request

  • Base URL: https://app.tracepass.eu
  • URL: https://app.tracepass.eu/api/oauth/register
  • Auth: none required

Request body

client_namestring required
redirect_urisstring[] required
scopestring
token_endpoint_auth_method'none' | 'client_secret_post'

Example request

{
  "client_name": "Acme ERP Connector",
  "redirect_uris": [
    "https://acme.example/oauth/callback"
  ],
  "scope": "passports:read passports:write offline_access"
}

Response

Client registered. client_secret present only for confidential clients.

client_idstring
client_secretstring

Returned ONCE; confidential clients only.

client_namestring
redirect_urisstring[]
scopestring
token_endpoint_auth_methodstring

Example response

{
  "client_id": "oac_3f9a..."
}

Changes

No recorded changes to this operation across all 1 revision of this API.