Sign in
latestOpenAPI 3.0.3GitGuardian2026-08-201871515.0 MB

511b067cdcb1

OAuth2

Dynamically register an OAuth 2.0 client.

Dynamic Client Registration endpoint as defined by RFC 7591.

Allows OAuth clients (notably MCP clients) to register themselves without out-of-band coordination. The endpoint is unauthenticated; the workspace administrator can disable it through workspace preferences, in which case the endpoint returns 404.

Only the authorization_code grant type and the code response type are supported. Both public clients (token_endpoint_auth_method=none) and confidential clients (token_endpoint_auth_method=client_secret_post) are allowed.

post/v1/oauth/register

Request body

client_namestring nullable

Human-readable client name displayed on the consent screen.

redirect_urisstring[] required

Allowed redirect URIs. At least one is required; each must be 2048 characters or fewer.

token_endpoint_auth_method'none' | 'client_secret_post'

Authentication method the client uses at the token endpoint. none is for public (PKCE-only) clients; client_secret_post is for confidential clients that send their secret in the token request body.

grant_typesstring[] nullable

Grant types the client may use. Only authorization_code is supported; omit to use the default.

response_typesstring[] nullable

Response types the client may use at the authorization endpoint. Only code is supported; omit to use the default.

scopestring nullable

Space-separated list of scopes the client may request. Defaults to all scopes the workspace allows if omitted.

Example request

{
  "client_name": "My MCP client",
  "redirect_uris": [
    "https://app.example.com/oauth/callback"
  ],
  "grant_types": [
    "authorization_code"
  ],
  "response_types": [
    "code"
  ],
  "scope": "scan incidents:read"
}

Response

Client successfully registered. (RFC 7591 §3.2.1)

client_idstring required

Generated client identifier.

client_namestring nullable
redirect_urisstring[] required
grant_typesstring[] required
response_typesstring[] required
token_endpoint_auth_methodstring required
scopestring required

Space-separated list of scopes granted to the client.

client_id_issued_atinteger required

Unix timestamp at which the client_id was issued.

client_secretstring

Generated client secret. Present only for confidential clients (token_endpoint_auth_method=client_secret_post). The plaintext value is returned exactly once; store it securely.

client_secret_expires_atinteger required

Unix timestamp at which the client_secret expires. 0 means the secret does not expire.

Example response

{
  "client_id": "gg_client_AbCdEf123456",
  "client_name": "My MCP client",
  "redirect_uris": [
    "https://app.example.com/oauth/callback"
  ],
  "grant_types": [
    "authorization_code"
  ],
  "response_types": [
    "code"
  ],
  "token_endpoint_auth_method": "none",
  "scope": "scan incidents:read",
  "client_id_issued_at": 1716230400,
  "client_secret": "gg_secret_AbCdEf123456"
}