---
title: "Dynamically register an OAuth 2.0 client."
method: POST
path: "/v1/oauth/register"
tags: ["OAuth2"]
---

# Dynamically register an OAuth 2.0 client.

`POST /v1/oauth/register`

Dynamic Client Registration endpoint as defined by
[RFC 7591](https://www.rfc-editor.org/rfc/rfc7591).

Allows OAuth clients (notably MCP clients) to register
themselves without out-of-band coordination. The endpoint is
unauthenticated; the workspace administrator can disable it
through workspace preferences, in which case the endpoint
returns `404`.

Only the `authorization_code` grant type and the `code`
response type are supported. Both public clients
(`token_endpoint_auth_method=none`) and confidential clients
(`token_endpoint_auth_method=client_secret_post`) are allowed.

## Request body

- object
  - `client_name` string, nullable — Human-readable client name displayed on the consent screen.
  - `redirect_uris` string[], required — Allowed redirect URIs. At least one is required; each must be 2048 characters or fewer.
  - `token_endpoint_auth_method` 'none' | 'client_secret_post' — Authentication method the client uses at the token endpoint. `none` is for public (PKCE-only) clients; `client_secret_post` is for confidential clients that send their secret in the token request body.
  - `grant_types` string[], nullable — Grant types the client may use. Only `authorization_code` is supported; omit to use the default.
  - `response_types` string[], nullable — Response types the client may use at the authorization endpoint. Only `code` is supported; omit to use the default.
  - `scope` string, nullable — Space-separated list of scopes the client may request. Defaults to all scopes the workspace allows if omitted.

## Response `201`

Client successfully registered.
([RFC 7591 §3.2.1](https://www.rfc-editor.org/rfc/rfc7591#section-3.2.1))

- object
  - `client_id` string, required — Generated client identifier.
  - `client_name` string, nullable
  - `redirect_uris` string[], required
  - `grant_types` string[], required
  - `response_types` string[], required
  - `token_endpoint_auth_method` string, required
  - `scope` string, required — Space-separated list of scopes granted to the client.
  - `client_id_issued_at` integer, required — Unix timestamp at which the client_id was issued.
  - `client_secret` string — Generated client secret. Present only for confidential clients (`token_endpoint_auth_method=client_secret_post`). The plaintext value is returned exactly once; store it securely.
  - `client_secret_expires_at` integer, required — Unix timestamp at which the client_secret expires. `0` means the secret does not expire.

## Other responses

- `400` — Invalid client metadata. ([RFC 7591 §3.2.2](https://www.rfc-editor.org/rfc/rfc7591#section-3.2.2))
- `404` — Dynamic Client Registration is disabled for this workspace.
- `429` — Rate limit exceeded. The registration endpoint is throttled to prevent abuse.

---

[API](https://skmtc.net/gitguardian/apis/gitguardian-api.md) · [All operations](https://skmtc.net/gitguardian/apis/gitguardian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitguardian/gitguardian-api/revisions/511b067cdcb1/schema)