OAuthClientRegistrationRequest
HTTP API schema
Request payload for registering a new OAuth 2.0 client per RFC 7591.
OAuthClientRegistrationRequest fields
- clientName
stringRequired A human-readable string name of the client to be presented to the end-user during authorization. If omitted, the authorization server may display the raw "client_id" value to the end-user instead. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
- clientUri
string A URL string of a web page providing information about the client. If present, the server should display this URL to the end-user in a clickable fashion. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
format: "uri"
- clientUriLocalized
object Localized versions of the client URI using language tags as keys (BCP 47 format). The keys are language tags and values are the localized URIs. See https://datatracker.ietf.org/doc/html/rfc7591#section-2.2
- *
string format: "uri"
- *
- logoUri
string A URL string that references a logo for the client. If present, the server should display this image to the end-user during approval. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
format: "uri"
- logoUriLocalized
object Localized versions of the logo URI using language tags as keys (BCP 47 format). The keys are language tags and values are the localized logo URIs. See https://datatracker.ietf.org/doc/html/rfc7591#section-2.2
- *
string format: "uri"
- *
- redirectUris
array<string> An array of redirection URI strings for use in redirect-based flows such as the authorization code and implicit flows. Clients using these flows must register their redirection URI values. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
- Item
string format: "uri"
- Item
- allowedOrigins
array<string> An array of authorized JavaScript origin strings. When set, the server validates the Origin header on token requests against this list. Origins are scheme + host (+ optional port), with no path.
- Item
string format: "uri"
- Item
- grantTypes
array<string> An array of OAuth 2.0 grant type strings that the client can use at the token endpoint, each at most once. The token endpoint refuses any other grant with `unauthorized_client`, and a refresh token is issued only to a client that registered refresh_token. authorization_code requires redirect_uris; client_credentials requires a client_secret_post, client_secret_basic or private_key_jwt client. When omitted, the server registers authorization_code and refresh_token, or client_credentials for a private_key_jwt client, and returns the registered list (RFC 7591 lets the server substitute values). See https://datatracker.ietf.org/doc/html/rfc7591#section-2
uniqueItems: true
Default:
["authorization_code","refresh_token"]- Item
string Allowed values: authorization_code, client_credentials, refresh_token, urn:ietf:params:oauth:grant-type:device_code.
- Item
- responseTypes
array<string> An array of OAuth 2.0 response type strings that the client can use at the authorization endpoint. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
- Item
string Allowed values: code, token, id_token.
- Item
- tokenEndpointAuthMethod
string A string indicating the requested authentication method for the token endpoint. Values defined by this specification are "client_secret_post", "client_secret_basic", "client_secret_jwt", "private_key_jwt", and "none". See https://datatracker.ietf.org/doc/html/rfc7591#section-2
Default:
client_secret_basicAllowed values: client_secret_post, client_secret_basic, client_secret_jwt, private_key_jwt, none.
- tokenEndpointAuthSigningAlg
string A string containing a JWS signing algorithm (alg value) that MUST be used for signing the JWT used to authenticate the client at the token endpoint for the "private_key_jwt" and "client_secret_jwt" authentication methods. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
Allowed values: RS256, ES256.
- scopes
array<OAuthScope> List of OAuth scopes that this client can request. This is the primary field for specifying scopes. Scopes are mapped to Cedar permissions (e.g., "endpoint:read" maps to "endpoint.read"). See https://datatracker.ietf.org/doc/html/rfc7591#section-2
- ItemOAuthScope
scopes[]: Reference OAuthScope
- scope
string A string containing a space-separated list of scope values that the client can use when requesting access tokens. This is a convenience field that represents the scopes array as a space-separated string. If both scope and scopes are provided, scopes takes precedence. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
- contacts
array<string> An array of strings representing ways to contact people responsible for this client, typically email addresses. The authorization server may make these contact addresses available to end-users for support requests for the client. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
- Item
string format: "email"
- Item
- tosUri
string A URL string that points to a human-readable terms of service document for the client that describes a contractual relationship between the end-user and the client that the end-user accepts when authorizing the client. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
format: "uri"
- tosUriLocalized
object Localized versions of the terms of service URI using language tags as keys (BCP 47 format). The keys are language tags and values are the localized terms of service URIs. See https://datatracker.ietf.org/doc/html/rfc7591#section-2.2
- *
string format: "uri"
- *
- policyUri
string A URL string that points to a human-readable privacy policy document that describes how the deployment organization collects, uses, retains, and discloses personal data. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
format: "uri"
- policyUriLocalized
object Localized versions of the privacy policy URI using language tags as keys (BCP 47 format). The keys are language tags and values are the localized privacy policy URIs. See https://datatracker.ietf.org/doc/html/rfc7591#section-2.2
- *
string format: "uri"
- *
- jwksUri
string A URL string referencing the client's JSON Web Key (JWK) Set document, which contains the client's public keys. These keys can be used by higher-level protocols that use signing or encryption. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
format: "uri"
- jwksOAuthClientJwks
jwks: Reference OAuthClientJwks
- softwareId
string A unique identifier string assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered. See https://datatracker.ietf.org/doc/html/rfc7591#section-2
- softwareVersion
string A version identifier string for the client software identified by "software_id". The value of the "software_version" should change on any update to the client software identified by the same "software_id". See https://datatracker.ietf.org/doc/html/rfc7591#section-2