Dynamic client registration (RFC 7591)

POST

/oauth/register

curl --request POST \
  --url https://api.harperharbor.com/oauth/register \
  --header 'Content-Type: application/json' \
  --data '{ "client_name": "example", "redirect_uris": [ "https://example.com" ], "grant_types": [ "authorization_code" ] }'

• Production

Registers a public client (no secret; token_endpoint_auth_method is none). client_name: 1-80 characters after whitespace normalization, no control/bidi characters. redirect_uris: at least one; https with a host, http only for localhost/loopback IPs, or a custom scheme with a host or path (javascript, data, file, vbscript are rejected; fragments and userinfo are rejected). grant_types: subset of authorization_code, refresh_token; must include authorization_code; defaults to both when omitted.

Request Body^required

Media typeapplication/json

object

client_name

required

string

>= 1 characters <= 80 characters

redirect_uris

required

Array<string>

>= 1 items

grant_types

Defaults to both.

Array<string>

Allowed values: authorization_code refresh_token

Responses

201

Registered client.

Media typeapplication/json

object

client_id

required

Prefixed mcp_client_.

string

client_name

required

string

redirect_uris

required

Array<string>

grant_types

required

Array<string>

response_types

required

["code"].

Array<string>

token_endpoint_auth_method

required

string

Allowed values: none

Example

{
  "token_endpoint_auth_method": "none"
}

400

invalid_client_metadata or invalid_redirect_uri.

Media typeapplication/json

object

error

required

OAuth error code.

string

redirect_url

Only on the internal consent endpoints when the request expired.

string

retry_after

Seconds to wait before trying again; only with rate_limited.

integer

Example^generated

{
  "error": "example",
  "redirect_url": "example",
  "retry_after": 1
}