Skip to content
openapi
/Authorization/
Create OAuth2 client

Create OAuth2 client

Request

Register a new OAuth2 client for dynamic client registration. This endpoint implements the Dynamic Client Registration Protocol (RFC 7591), using camelCase field names instead of the RFC's snake_case convention (e.g., redirectUris instead of redirect_uris, grantTypes instead of grant_types). The name field is required. Other fields are optional. If not provided:

  • redirectUris defaults to an empty array. Note: When using the authorization_code grant type, redirectUris must be provided (per RFC 7591 Section 2).
  • scopes defaults to all available scopes (menu:read, menu:write, orders:read, orders:write, revenue:read)
  • grantTypes defaults to authorization_code and client_credentials

These defaults interact: a request that supplies only name pairs authorization_code with an empty redirectUris, which is not a usable combination. Supply redirectUris explicitly to register the authorization_code grant, or set grantTypes to client_credentials alone for a client that needs no redirect URI.

Refresh tokens require no registration and refresh_token is not a value you can register in grantTypes. The token endpoint returns a refresh token alongside every access token it issues for the authorization_code grant, and accepts grant_type=refresh_token from any client presenting a refresh token issued to it. The client_credentials grant returns no refresh token (RFC 6749 Section 4.4.3); those clients request a new access token with their own credentials instead.

Returns the registered client information per RFC 7591, including:

  • clientId and clientSecret (must be stored securely)
  • clientIdIssuedAt and clientSecretExpiresAt timestamps
  • All registered client metadata (name, redirectUris, scopes, grantTypes)
Bodyapplication/jsonrequired
namestringrequired

Client name.

redirectUrisArray of strings, (uri)

List of redirect URIs (optional, defaults to empty array).

Default:[]
scopesArray of strings

List of scopes.

Default:["menu:read","menu:write","orders:read","orders:write","revenue:read"]
Items Enum:"menu:read""menu:write""orders:read""orders:write""revenue:read"
grantTypesArray of strings

List of grant types. refresh_token is not registrable; any client holding a refresh token may present it at the token endpoint.

Default:["authorization_code","client_credentials"]
Items Enum:"authorization_code""client_credentials"
curl -i -X POST \
  https://cafe.redocly.com/_mock/openapi/cafe/oauth2/register \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "auth",
    "scopes": [
      "menu:read",
      "menu:write",
      "orders:read",
      "orders:write",
      "revenue:read"
    ],
    "grantTypes": [
      "client_credentials"
    ]
  }'

Responses

OAuth2 client registered successfully.

Bodyapplication/json
clientIdstringrequired

Client identifier issued by the authorization server.

clientSecretstringrequired

Client secret issued by the authorization server.

clientIdIssuedAtinteger, (int64)required

Time when the client_id is issued, represented as seconds since epoch (RFC7591).

clientSecretExpiresAtinteger, (int64)required

Time at which the client_secret expires, represented as seconds since epoch. 0 indicates the secret does not expire (RFC 7591).

namestring

Client name (registered metadata).

redirectUrisArray of strings, (uri)

List of redirect URIs (registered metadata).

registrationClientUristring, (uri)required

URL of the client configuration endpoint for managing this client registration (RFC 7592).

registrationAccessTokenstringrequired

Access token to be used at the client configuration endpoint for managing this client registration (RFC 7592).

scopesArray of strings

List of scopes (registered metadata).

Items Enum:"menu:read""menu:write""orders:read""orders:write""revenue:read"
grantTypesArray of strings

List of grant types (registered metadata).

Items Enum:"authorization_code""client_credentials"
Response
{
  "clientId": "string",
  "clientSecret": "string",
  "clientIdIssuedAt": 0,
  "clientSecretExpiresAt": 0,
  "name": "string",
  "redirectUris": [
    "http://example.com"
  ],
  "registrationClientUri": "http://example.com",
  "registrationAccessToken": "string",
  "scopes": [
    "menu:read"
  ],
  "grantTypes": [
    "authorization_code"
  ]
}