Create OAuth Client

POST /oauth-clients

Creates a new OAuth client registration. This endpoint allows you to register a new OAuth client with Port OS. The client will be assigned a unique client ID and a client secret that can be used for OAuth authentication flows. The client secret is only returned once during creation, so make sure to store it securely.

Requires a signed user/session or the existing authenticated client flow. The anonymous DCR delegated device profile cannot invoke this operation.

Required scope

Any authenticated access token

Request body

Fields

clientNamestringRequired

A human-readable string name of the client to be presented to the end-user during authorization. If omitted, the authorization server may display the raw "client_id" value to the end-user instead. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

clientUristring

A URL string of a web page providing information about the client. If present, the server should display this URL to the end-user in a clickable fashion. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

format: "uri"

clientUriLocalizedobject

Localized versions of the client URI using language tags as keys (BCP 47 format). The keys are language tags and values are the localized URIs. See https://datatracker.ietf.org/doc/html/rfc7591#section-2.2

logoUristring

A URL string that references a logo for the client. If present, the server should display this image to the end-user during approval. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

format: "uri"

logoUriLocalizedobject

Localized versions of the logo URI using language tags as keys (BCP 47 format). The keys are language tags and values are the localized logo URIs. See https://datatracker.ietf.org/doc/html/rfc7591#section-2.2

redirectUrisarray<string>

An array of redirection URI strings for use in redirect-based flows such as the authorization code and implicit flows. Clients using these flows must register their redirection URI values. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

allowedOriginsarray<string>

An array of authorized JavaScript origin strings. When set, the server validates the Origin header on token requests against this list. Origins are scheme + host (+ optional port), with no path.

grantTypesarray<string>

An array of OAuth 2.0 grant type strings that the client can use at the token endpoint, each at most once. The token endpoint refuses any other grant with `unauthorized_client`, and a refresh token is issued only to a client that registered refresh_token. authorization_code requires redirect_uris; client_credentials requires a client_secret_post, client_secret_basic or private_key_jwt client. When omitted, the server registers authorization_code and refresh_token, or client_credentials for a private_key_jwt client, and returns the registered list (RFC 7591 lets the server substitute values). See https://datatracker.ietf.org/doc/html/rfc7591#section-2

uniqueItems: true

Default: ["authorization_code","refresh_token"]

responseTypesarray<string>

An array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

tokenEndpointAuthMethodstring

A string indicating the requested authentication method for the token endpoint. Values defined by this specification are "client_secret_post", "client_secret_basic", "client_secret_jwt", "private_key_jwt", and "none". See https://datatracker.ietf.org/doc/html/rfc7591#section-2

Default: client_secret_basic

Allowed values: client_secret_post, client_secret_basic, client_secret_jwt, private_key_jwt, none.

tokenEndpointAuthSigningAlgstring

A string containing a JWS signing algorithm (alg value) that MUST be used for signing the JWT used to authenticate the client at the token endpoint for the "private_key_jwt" and "client_secret_jwt" authentication methods. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

Allowed values: RS256, ES256.

scopesarray<OAuthScope>

List of OAuth scopes that this client can request. This is the primary field for specifying scopes. Scopes are mapped to Cedar permissions (e.g., "endpoint:read" maps to "endpoint.read"). See https://datatracker.ietf.org/doc/html/rfc7591#section-2

scopestring

A string containing a space-separated list of scope values that the client can use when requesting access tokens. This is a convenience field that represents the scopes array as a space-separated string. If both scope and scopes are provided, scopes takes precedence. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

contactsarray<string>

An array of strings representing ways to contact people responsible for this client, typically email addresses. The authorization server may make these contact addresses available to end-users for support requests for the client. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

tosUristring

A URL string that points to a human-readable terms of service document for the client that describes a contractual relationship between the end-user and the client that the end-user accepts when authorizing the client. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

format: "uri"

tosUriLocalizedobject

Localized versions of the terms of service URI using language tags as keys (BCP 47 format). The keys are language tags and values are the localized terms of service URIs. See https://datatracker.ietf.org/doc/html/rfc7591#section-2.2

policyUristring

A URL string that points to a human-readable privacy policy document that describes how the deployment organization collects, uses, retains, and discloses personal data. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

format: "uri"

policyUriLocalizedobject

Localized versions of the privacy policy URI using language tags as keys (BCP 47 format). The keys are language tags and values are the localized privacy policy URIs. See https://datatracker.ietf.org/doc/html/rfc7591#section-2.2

jwksUristring

A URL string referencing the client's JSON Web Key (JWK) Set document, which contains the client's public keys. These keys can be used by higher-level protocols that use signing or encryption. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

format: "uri"

jwksOAuthClientJwks

The client's JSON Web Key Set document value, which contains the client's public keys. This parameter is intended to be used by clients that cannot use the "jwks_uri" parameter, such as native clients that cannot host public URLs. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

softwareIdstring

A unique identifier string assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered. See https://datatracker.ietf.org/doc/html/rfc7591#section-2

softwareVersionstring

A version identifier string for the client software identified by "software_id". The value of the "software_version" should change on any update to the client software identified by the same "software_id". See https://datatracker.ietf.org/doc/html/rfc7591#section-2

Returns

200

OAuth client created successfully

Fields

clientIdstringRequired: The created OAuth client ID
clientSecretstringRequired: The OAuth client secret (only returned on creation). This is the secret string known only to the client and the authorization server, used for authenticating the client. See https://datatracker.ietf.org/doc/html/rfc7591#section-2.2
clientSecretExpiresAtinteger: An integer indicating the expiration time of the client secret, represented as the number of seconds since the Unix epoch (1970-01-01T00:00:00Z). A value of 0 indicates that the secret does not expire. See https://datatracker.ietf.org/doc/html/rfc7591#section-2.2

Errors

400

Invalid request payload

Check the request fields and any validation details, then correct the payload.

401

Unauthorized - invalid or missing authentication token

Obtain a valid access token, then retry.

500

Internal server error

Retry with backoff only when the operation is safe to repeat. Include the error code when reporting persistent failures.