Skip to content

Create OAuth2 client

Request

Register a new OAuth2 client, implementing the Dynamic Client Registration Protocol (RFC 7591) with the standard snake_case metadata names, so off-the-shelf DCR clients work without modification. Responses use only the standard snake_case names (RFC 7591 Section 3.2.1).

All fields are optional. If not provided:

  • scope defaults to all available scopes (menu:read menu:write orders:read orders:write revenue:read)
  • grant_types defaults to authorization_code, client_credentials, and refresh_token
  • token_endpoint_auth_method defaults to client_secret_basic (RFC 7591 Section 2); both supported methods are accepted at the token endpoint regardless of the registered value

This server registers confidential clients only: every client is issued a client_secret, and token_endpoint_auth_method: none (public clients such as SPAs or mobile apps, RFC 7591 Section 2) is not supported by design.

redirect_uris is required whenever the effective grant types include authorization_code (RFC 7591 Section 2), including when grant_types is omitted, since the default includes it. Register with grant_types: ["client_credentials"] for a client that needs no redirect URI.

Refresh token behavior follows the registered grant types: the token endpoint returns a refresh token with authorization_code grant responses only when the client registered the refresh_token grant type. The client_credentials grant never returns refresh tokens (RFC 6749 Section 4.4.3). Those clients request a new access token with their own credentials instead.

Returns the registered client information per RFC 7591 Section 3.2.1, including:

  • client_id and client_secret (must be stored securely)
  • client_id_issued_at and client_secret_expires_at timestamps
  • registration_client_uri and registration_access_token for managing the registration (RFC 7592)
  • All registered client metadata

Errors use the RFC 7591 Section 3.2.2 format: 400 with error set to invalid_redirect_uri or invalid_client_metadata and a human-readable error_description.

Bodyapplication/jsonrequired
Any of:

Effective grant types include authorization_code — explicitly, or by default when grant_types is omitted. A non-empty redirect_uris is required. Other grant types (client_credentials, refresh_token) can be registered alongside.

redirect_urisArray of strings, (uri), non-emptyrequired

Redirect URIs for the authorization_code grant. Compared with exact string matching at authorization time (RFC 6749 Section 3.1.2.3).

client_namestring

Human-readable client name, displayed on the authorization consent screen.

scopestring^(menu:read|menu:write|orders:read|orders:wri...

Space-separated list of scopes. Defaults to all available scopes.

Default:"menu:read menu:write orders:read orders:write revenue:read"
Example:"menu:read orders:read orders:write"
grant_typesArray of strings

Grant types the client may use. A refresh token is issued with authorization_code grant responses only when refresh_token is included here. The client_credentials grant never returns one (RFC 6749 Section 4.4.3).

Default:["authorization_code","client_credentials","refresh_token"]
Items Enum:"authorization_code""client_credentials""refresh_token"
token_endpoint_auth_methodstring

Requested client authentication method for the token endpoint, registered as client metadata and echoed in registration responses. Defaults to client_secret_basic (RFC 7591 Section 2). The token and revocation endpoints accept both methods for every client regardless.

Default:"client_secret_basic"
Enum:"client_secret_basic""client_secret_post"
curl -i -X POST \
  https://cafe.redocly.com/_mock/openapi/cafe/oauth2/register \
  -H 'Content-Type: application/json' \
  -d '{
    "client_name": "auth",
    "scope": "menu:read menu:write orders:read orders:write revenue:read",
    "grant_types": [
      "client_credentials"
    ]
  }'

Responses

OAuth2 client registered successfully.

Bodyapplication/json
client_idstringrequired

Client identifier issued by the authorization server.

client_secretstringrequired

Client secret issued by the authorization server. Store it securely.

client_id_issued_atinteger, (int64)required

Time when the client_id is issued, represented as seconds since epoch (RFC 7591).

client_secret_expires_atinteger, (int64)required

Time at which the client_secret expires, represented as seconds since epoch. 0 indicates the secret does not expire (RFC 7591).

registration_client_uristring, (uri)required

URL of the client configuration endpoint for managing this client registration (RFC 7592).

registration_access_tokenstringrequired

Bearer token for the client configuration endpoint (RFC 7592). Store it securely.

client_namestring

Client name (registered metadata). Omitted for clients registered without a name.

redirect_urisArray of strings, (uri)required

Registered redirect URIs.

grant_typesArray of stringsrequired

Registered grant types.

Items Enum:"authorization_code""client_credentials""refresh_token"
scopestringrequired

Space-separated registered scopes.

token_endpoint_auth_methodstringrequired

Registered token endpoint authentication method. Defaults to client_secret_basic when not requested at registration (RFC 7591 Section 2). The token and revocation endpoints accept both methods for every client regardless.

Enum:"client_secret_basic""client_secret_post"
Response
{
  "client_id": "string",
  "client_secret": "string",
  "client_id_issued_at": 0,
  "client_secret_expires_at": 0,
  "registration_client_uri": "http://example.com",
  "registration_access_token": "string",
  "client_name": "string",
  "redirect_uris": [
    "http://example.com"
  ],
  "grant_types": [
    "authorization_code"
  ],
  "scope": "string",
  "token_endpoint_auth_method": "client_secret_basic"
}