Dynamically register a MCP client.

Registers a new public OAuth client for use with the MCP Authorization Code

Note - Fields like client_uri, logo_uri, contacts etc. are not supported yet.

Body Params
string
required
length ≤ 256

Human-readable client name. Shown on the consent screen.

redirect_uris
array of strings
required
length between 1 and 10

Redirection URIs. Must be HTTPS (non-loopback) or loopback HTTP (http://localhost, http://127.0.0.1, http://[::1]) only. No wildcards, no fragments. Validated against application_type at registration and exact-matched at authorize/token time.

redirect_uris*
string
enum

Must be "none" if supplied. The server always provisions a public (PKCE-only) client and issues no client_secret. Defaults to ["none"]

Allowed:
grant_types
array of strings

Only authorization code supported for Public MCP Clients. Any other value (e.g. client_credentials, implicit) is rejected with invalid_client_metadata. Defaults to ["authorization_code"]

grant_types
Allowed:
response_types
array of strings

Must be "code" if supplied. Defaults to ["code"].

response_types
Allowed:
Responses

400

Registration failed. OAuth error codes per <a href=https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2>RFC 7591 Section 3.2.2.

  • invalid_redirect_uri - A redirect URI is missing or fails validation.

  • invalid_client_metadata - Disallowed grant_types/response_types/token_endpoint_auth_method,
    or application_type conflicts with the supplied redirect URIs.

  • invalid_request - Malformed JSON or missing body.

413

Request body exceeds the maximum allowed size.

429

Registration rate limit exceeded (per-IP or global DCR cap). A Retry-After header SHOULD be present.

Language
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json