Register a public OAuth client

POST /oauth/register

RFC 7591 anonymous public-client registration. No Google session is required. This registration gives no user or resource permissions. Public clients must use PKCE S256, resource-bound authorization_code flow and explicit user consent. Client name, software_id and client_uri are unverified claims, not proof of Muse or any other product. Untrusted software_statement is rejected. Remote callbacks require HTTPS. HTTP is allowed for localhost or literal loopback IPs only, and local callbacks cannot be mixed with remote callbacks. SHA-256 of canonical client_name, sorted redirect_uris, sorted grant_types, sorted response_types and token_endpoint_auth_method identifies a registration. A repeated fingerprint returns the original client_id and accepted metadata, including its original scopes; it never overwrites metadata or expands scopes. Reused registrations do not consume new-registration quota. Unknown metadata extensions are ignored as required by RFC 7591. The deployment enforces rolling registration and retained-client quotas.

Required scope

Not required

Request body

Fields

client_namestring

Unverified display name.

maxLength: 200

redirect_urisarray<string>Required

Exact callbacks must form either an entirely localhost/loopback set or an entirely remote HTTPS set. HTTP is allowed only for localhost or literal loopback IPs. Local and remote callbacks cannot be mixed; user information and fragments are forbidden.

token_endpoint_auth_methodstringRequired

Allowed values: none.

grant_typesarray<string>

authorization_code, optionally with refresh_token, each at most once. Omitted, the server registers authorization_code and refresh_token and returns them.

uniqueItems: true

response_typesarray<string>

scopestring

Space-separated OAuthScope values accepted by the deployment DCR allowed_scopes policy. Omission selects endpoint:read (the least-privilege default) when the deployment allows it, and is refused otherwise.

client_uristring

Unverified descriptive URL; never fetched as evidence.

maxLength: 2048

software_idstring

Unverified software claim.

maxLength: 200

software_versionstring

maxLength: 100

software_statementstring

Unsupported; rejected if supplied.

Returns

201

Public client created; no client_secret is issued.

Fields

(payload)any

Errors

400

Invalid metadata, redirect URI, or unapproved software statement.

Check the request fields and any validation details, then correct the payload.

415

Use application/json.

Inspect the returned code and family and follow the error handling guide.

429

Registration quota reached. Wait before retrying; do not loop.

Wait for Retry-After or details.retryAfterSeconds when supplied; otherwise use backoff.

Response headers

Retry-After: See the source specification for this header.

503

Registration storage unavailable.

Wait for the provider or bridge to recover, then retry safely with backoff.