v47

latestOpenAPI 3.0.3MIT Licenseraw.githubusercontent.com2026-08-015915132.9 KB

oauth-server

Register a new OAuth client dynamically (public endpoint).

Allows applications to register as OAuth clients with this server dynamically. This follows the OAuth 2.0 Dynamic Client Registration Protocol. Only available when OAuth server is enabled and dynamic registration is allowed (set GOTRUE_OAUTH_SERVER_ENABLED=true and GOTRUE_OAUTH_SERVER_ALLOW_DYNAMIC_REGISTRATION=true for self-hosted or enable both settings in Supabase Dashboard).

post/oauth/clients/register

Request body

client_namestring required

Human-readable name of the client application

client_uristring uri

URL of the client application's homepage

logo_uristring uri

URL of the client application's logo

redirect_urisstring[] required

Array of redirect URIs used by the client (maximum 10)

client_type'public' | 'confidential'

Type of the client. Optional. If not provided, will be inferred from token_endpoint_auth_method or defaults to 'confidential'. Public clients are used for applications that cannot securely store credentials (e.g., SPAs, mobile apps). Confidential clients can securely store credentials (e.g., server-side applications).

token_endpoint_auth_method'none' | 'client_secret_basic' | 'client_secret_post'

Authentication method for the token endpoint. Optional. 'none' is for public clients, 'client_secret_basic' and 'client_secret_post' are for confidential clients. If provided, must be consistent with client_type. If not provided, will be inferred from client_type.

grant_typesstring[]

OAuth grant types the client will use (defaults to both if not specified)

response_typesstring[]

OAuth response types the client will use

scopestring

Space-separated list of scope values

Response

OAuth client registered successfully

client_idstring

Unique client identifier

client_namestring

Human-readable name of the client application

client_secretstring

Client secret for confidential clients (only returned on registration/regeneration)

client_type'public' | 'confidential'

Type of the client

token_endpoint_auth_method'none' | 'client_secret_basic' | 'client_secret_post'

Authentication method for the token endpoint

registration_type'dynamic' | 'manual'

Registration type of the client

client_uristring uri

URL of the client application's homepage

logo_uristring uri

URL of the client application's logo

redirect_urisstring[]

Array of redirect URIs used by the client

grant_typesstring[]

OAuth grant types the client is authorized to use

response_typesstring[]

OAuth response types the client can use

scopestring

Space-separated list of scope values

created_atstring date-time

updated_atstring date-time