---
title: "Register an OAuth client (Dynamic Client Registration)."
method: POST
path: "/api/oauth/register"
tags: ["OAuth"]
---

# Register an OAuth client (Dynamic Client Registration).

`POST /api/oauth/register`

## Request

- Base URL: `https://app.tracepass.eu`
- URL: `https://app.tracepass.eu/api/oauth/register`
- Auth: none required

RFC 7591 Dynamic Client Registration. Public, unauthenticated —
a hosted client (e.g. an MCP host) self-registers before any
user is involved. Public clients (PKCE-only) omit
`token_endpoint_auth_method` or set it to `none` and receive no
secret; confidential clients set `client_secret_post` and
receive a `client_secret` once. Rate-limited per IP.
(Developers can also register apps interactively at Developer →
OAuth Apps in the dashboard.)

## Request body

- object
  - `client_name` string, required
  - `redirect_uris` string[], required
  - `scope` string
  - `token_endpoint_auth_method` 'none' | 'client_secret_post'

## Response `201`

Client registered. `client_secret` present only for confidential clients.

- object
  - `client_id` string
  - `client_secret` string: Returned ONCE; confidential clients only.
  - `client_name` string
  - `redirect_uris` string[]
  - `scope` string
  - `token_endpoint_auth_method` string

## Other responses

- `400`: Invalid client metadata or redirect_uri.

---

[API](https://skmtc.dev/tracepass/apis/tracepass-api.md) · [All operations](https://skmtc.dev/tracepass/apis/tracepass-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tracepass/apis/tracepass-api/revisions/60ddeb25638b?raw)