---
title: "Register an OAuth client (RFC 7591)"
method: POST
path: "/oauth/register"
tags: ["OAuth / MCP"]
---

# Register an OAuth client (RFC 7591)

`POST /oauth/register`

## Request

- Base URL: `https://whatareyoudo.ing/api/v1`
- URL: `https://whatareyoudo.ing/api/v1/oauth/register`
- Auth: none declared

Open registration, as the MCP authorization spec expects. Redirect URIs must be https on an allowed AI platform host (OAUTH_REDIRECT_HOSTS) or http on a loopback address. A confidential client (client_secret_post / client_secret_basic, the default) gets a client_secret, returned only here.

## Request body

- OAuthClientRegistrationRequest
  - `redirect_uris` string[], required
  - `client_name` string
  - `client_uri` string
  - `grant_types` string[]
  - `response_types` string[]
  - `token_endpoint_auth_method` 'none' | 'client_secret_post' | 'client_secret_basic'

## Response `201`

Registered

- OAuthClientRegistration
  - `client_id` string, required
  - `client_id_issued_at` integer, required
  - `client_secret` string
  - `client_secret_expires_at` integer
  - `client_name` string, required
  - `client_uri` string
  - `redirect_uris` string[], required
  - `grant_types` string[], required
  - `response_types` string[], required
  - `token_endpoint_auth_method` string, required

## Other responses

- `400`: invalid_redirect_uri or invalid_client_metadata

---

[API](https://skmtc.dev/whatareyoudo/apis/whatcha-api.md) · [All operations](https://skmtc.dev/whatareyoudo/apis/whatcha-api/llms.txt) · [OpenAPI document](https://skmtc.dev/whatareyoudo/apis/whatcha-api/revisions/48dd8a54abea?raw)