Register an OAuth client (DCR)

Request

Minimal Dynamic Client Registration (RFC 7591) for MCP hosts and other clients that are not pre-registered. Registration only issues a client_id — access to any data still requires the user login/consent flow and granted scopes.

Public clients (native apps, local MCP packages, agent hosts without a secure backend) receive no client_secret and must use Authorization Code + PKCE. A client_id supplied as an HTTPS URL pointing to a Client ID Metadata Document (CIMD) is also accepted at the authorization endpoint without prior registration.

Registration is rate-limited and monitored for abuse; redirect URIs are validated.

Bodyapplication/jsonrequired

client_namestringrequired

Human-readable OAuth client name shown on the consent screen.

redirect_urisArray of strings, (uri), [ 1 .. 10 ] itemsrequired

Redirect URIs, compared exactly — no wildcards, no subdomain substitution. Two forms are accepted:

Absolute HTTPS for web-hosted callbacks: https://app.example.com/oauth/callback.
Loopback for native and CLI clients (RFC 8252): http://127.0.0.1/callback or http://[::1]/callback. The port is dynamic — it is chosen at runtime and is ignored when matching, so a client does not have to register every port it may bind.

localhost is not accepted as an equivalent of the loopback address: it resolves through DNS and the hosts file, so it can be pointed elsewhere. Register the literal IP instead. Any other plain-HTTP host is rejected.

grant_typesArray of strings

Default:["authorization_code"]

Items Enum:"authorization_code""refresh_token"

token_endpoint_auth_methodstring

none declares a public client (PKCE only, no secret).

Value:"none"

scopestring

Space-separated scopes requested by the client metadata.

client_uristring, (uri)

Public client home page URI.

logo_uristring, (uri)

Public logo URI for consent UI.

curl -i -X POST \
  https://developer.alteg.io/_mock/en/b2b-v3/openapi/oauth/register \
  -H 'Content-Type: application/json' \
  -d '{
    "client_name": "Example MCP Host",
    "redirect_uris": [
      "https://mcp-host.example.com/oauth/callback",
      "http://127.0.0.1/callback"
    ],
    "grant_types": [
      "authorization_code",
      "refresh_token"
    ],
    "token_endpoint_auth_method": "none"
  }'

Responses

Client registered.

Bodyapplication/json

client_idstringrequired

client_id_issued_atintegerrequired

Unix timestamp of registration.

redirect_urisArray of strings, (uri)required

grant_typesArray of stringsrequired

Items Enum:"authorization_code""refresh_token"

token_endpoint_auth_methodstringrequired

Value:"none"

client_namestring

Response

{
  "client_id": "altg_oauth_9c41",
  "client_id_issued_at": 1784900000,
  "client_name": "Example MCP Host",
  "redirect_uris": [
    "https://mcp-host.example.com/oauth/callback",
    "http://127.0.0.1/callback"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "token_endpoint_auth_method": "none"
}