POST/api/oidc/registerPublic

Dynamic client registration

OAuth 2.0 Dynamic Client Registration (RFC 7591 §3) for MCP and other OAuth clients. Off by default: the allow_dynamic_client_registration server setting must be on (the discovery document advertises registration_endpoint only then). A valid request creates an ownerless client application (owner_type = dynamic-client-registration, manageable by platform administrators only) with its redirect URIs registered as explicit callback URLs and, for confidential clients, a generated client secret. Registrations are rate limited per IP; bodies over 128 KiB are refused with 413. RFC 7592 configuration management is not implemented. Responses carry Cache-Control: no-store and Access-Control-Allow-Origin: *.

operationId post_api_oidc_registerOpenID Connect / OAuth 2.0

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials
None required
Notes
Open registration: no initial access token or other credential is required.

Request body

Required

application/json
DynamicClientRegistrationRequestUnknown members are ignored (RFC 7591 §2). jwks, jwks_uri and software_statement are not supported and refused with invalid_client_metadata.
PropertyTypeDescription
redirect_uris*string[]

REQUIRED. Absolute URIs without a fragment: https, http loopback-IP URIs and, when the deployment allows them, http://localhost URIs and private-use scheme URIs.

minItems: 1maxItems: 50

client_namestring

Display name; derived from the first redirect URI when absent.

token_endpoint_auth_method"none" | "client_secret_basic" | "client_secret_post"

Default client_secret_basic (RFC 7591 §2); none registers a public PKCE-only client.

grant_types"authorization_code" | "refresh_token"[]

Default ["authorization_code"]; must include authorization_code.

response_types"code"[]

Default ["code"].

client_uristring (uri)

The client's home page.

maxLength: 2048

logo_uristring (uri)

Logo to show on consent screens.

maxLength: 2048

tos_uristring (uri)

Terms of service.

maxLength: 2048

policy_uristring (uri)

Privacy policy.

maxLength: 2048

contactsstring[]

Ways to contact the people responsible for the client.

maxItems: 20

scopestring

Space-separated scopes the client intends to request (recorded, not enforced).

maxLength: 1024

software_idstring

maxLength: 255

software_versionstring

maxLength: 255

JSONExample
"redirect_uris"
"https://app.example.com/oauth/callback"
"client_name""string"
"token_endpoint_auth_method""none"
"grant_types"
"authorization_code"
"response_types"
"code"
"client_uri""https://example.com"
"logo_uri""https://example.com"
"tos_uri""https://example.com"
"policy_uri""https://example.com"
"contacts"
"string"
"scope""string"
"software_id""string"
"software_version""string"

Responses

HeaderTypeDescription
Cache-Controlstring
application/json
DynamicClientRegistrationResponseRFC 7591 §3.2.1 registration response. client_secret is returned once, only for confidential clients; client_secret_expires_at is 0 (secrets do not expire).
PropertyTypeDescription
client_id*string

minLength: 1

client_secretstring

minLength: 1

client_id_issued_at*integer

minimum: 0

client_secret_expires_atinteger

minimum: 0

redirect_uris*string[]

minItems: 1

client_name*string
token_endpoint_auth_method*"none" | "client_secret_basic" | "client_secret_post"
grant_types*"authorization_code" | "refresh_token"[]
response_types*"code"[]
client_uristring
logo_uristring
tos_uristring
policy_uristring
contactsstring[]
scopestring
software_idstring
software_versionstring
JSONExample
"client_id""string"
"client_secret""string"
"client_id_issued_at"1
"client_secret_expires_at"1
"redirect_uris"
"string"
"client_name""string"
"token_endpoint_auth_method""none"
"grant_types"
"authorization_code"
"response_types"
"code"
"client_uri""string"
"logo_uri""string"
"tos_uri""string"
"policy_uri""string"
"contacts"
"string"
"scope""string"
"software_id""string"
"software_version""string"

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/oidc/register' \
  -H 'Content-Type: application/json' \
  -d '{
  "redirect_uris": [
    "https://app.example.com/oauth/callback"
  ],
  "client_name": "string",
  "token_endpoint_auth_method": "none",
  "grant_types": [
    "authorization_code"
  ],
  "response_types": [
    "code"
  ],
  "client_uri": "https://example.com",
  "logo_uri": "https://example.com",
  "tos_uri": "https://example.com",
  "policy_uri": "https://example.com",
  "contacts": [
    "string"
  ],
  "scope": "string",
  "software_id": "string",
  "software_version": "string"
}'
POST /api/oidc/register | SchemaVaults Auth API