Register

RFC 7591 dynamic client registration. Off unless OAUTH_ALLOW_DCR says so.

It is an unauthenticated write endpoint, and registration grants nothing on its own — but a registered client_name is rendered to a human on the consent screen, which makes it a phishing surface: an attacker registers "Zeno Support", builds an authorize URL, and mails it. CIMD is preferred precisely because the client_id is then a URL whose origin the consent screen can show, which is a signal the attacker cannot forge.

Each redirect URI must be https://<host>…, an http:// loopback URI (127.0.0.1, [::1] or localhost; its port may differ at use time), or a known desktop client's own scheme and host — today only Cursor's cursor://anysphere.cursor-mcp/… (matched exactly). No userinfo, fragment, backslash or whitespace.

Mounted at /oauth/register, not /register — the gateway leaves that path to the SPA on purpose (api-routes.conf: "a plausible future SPA route, and a gateway 404 would silently shadow it").