Register a client

RFC 7591 dynamic client registration, for tools that arrive without a client_id.

POST /oauth/register

Dynamic client registration (RFC 7591), for tools that arrive without a pre-issued client_id: MCP clients, CLIs. Advertised only by the console issuer, https://loginwith.loginwith.dev.

Registered clients are public, belong to the console org, sign users in on the console login, and always go through consent.

Authorization

None. This route is public and rate-limited: 10 registrations per hour per IP.

Body

JSON.

Field	Type	Required	Description
`redirect_uris`	string[]	Yes	Non-empty. Each must be `https`, or `http` on `localhost`, `127.0.0.1` or `[::1]`.
`client_name`	string	No	Shown on the consent screen. Defaults to `Registered client`.
`token_endpoint_auth_method`	string	No	Only `none`: registered clients are public.

Response

201 with the client information response. There is no client_secret.

{
  "client_id": "cli_…",
  "client_id_issued_at": 1776470400,
  "client_name": "My CLI",
  "redirect_uris": ["http://127.0.0.1:8976/callback"],
  "token_endpoint_auth_method": "none",
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"]
}

Errors

The body is {"error": "…", "error_description": "…"}.

Status	`error`	When
`400`	`invalid_redirect_uri`	`redirect_uris` is missing or empty, or one is not a string, not `https` and not loopback.
`400`	`invalid_client_metadata`	`token_endpoint_auth_method` is anything other than `none`.
`429`	`rate_limited`	More than 10 registrations this hour from your IP. No `error_description`.

Example

curl -X POST https://loginwith.loginwith.dev/oauth/register \
  -H "Content-Type: application/json" \
  -d '{"client_name": "My CLI", "redirect_uris": ["http://127.0.0.1:8976/callback"]}'