Dynamic client registration (RFC 7591)

Register a new OAuth client. Returns a client_id (and client_secret for confidential clients). Public clients (PKCE-only) set token_endpoint_auth_method: "none" and receive no secret.

Anyone may register a client. Holding a client_id confers no privilege without a successful authorize flow.

Rate limited per caller IP (10/hour), counting every JSON attempt presented to it, not just successes, plus a 100/hour process-wide backstop that counts only attempts the per-IP limiter admits — a request the per-IP limiter rejects does not consume backstop capacity. Content-Type must be application/json — checked before either limiter is consulted, so a non-JSON request spends neither limiter's capacity. Clients that never complete a token grant are deleted after 30 days.