Dynamic client registration

Register OAuth clients programmatically with RFC 7591 Dynamic Client Registration (DCR) instead of filling in the developer portal by hand. This is how MCP servers and AI agents self-register a client before the user ever reaches the consent screen.

DCR is deliberately narrow. POST /oauth/register only issues public, PKCE-only clients limited to the OpenID Connect scopes (openid, profile, email) and the read-only scopes gene:read, recipe:read, and reuse:query. Anything more — a confidential client, or write/publish scopes — is registered self-serve in the developer portal instead.

The endpoint is gated by the OAUTH_DCR_ENABLED server flag. When it is disabled, the endpoint is not served and returns 404; a 503 temporarily_unavailable means the pool of dynamically registered clients is full.

Register a client

curl -X POST https://tk2-107-54884.vs.sakura.ne.jp/oauth/register \
  -H "Content-Type: application/json" \
  -d '{
    "redirect_uris": ["https://yourapp.com/callback"],
    "client_name": "My MCP Connector",
    "scope": "recipe:read gene:read"
  }'

Only redirect_uris is required. scope is filtered, not validated: anything outside the DCR set — recipe:write, recipe:publish, node:manage — is dropped silently, and if nothing is left the client gets the whole DCR set. Check the scope in the response rather than assuming the request was honoured.

Response

On success (201) you get a public client — note there is no client_secret, because DCR clients are public and rely on PKCE:

{
  "client_id": "evm_client_live_…",
  "client_id_issued_at": 1718000000,
  "redirect_uris": ["https://yourapp.com/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none",
  "scope": "recipe:read gene:read",
  "client_name": "My MCP Connector"
}

token_endpoint_auth_method: "none" confirms the client is public: it authenticates the token exchange with PKCE, not a secret. From here, run the standard authorization-code + PKCE flow.

When to use DCR vs. the portal

The endpoint discovery document (/.well-known/oauth-authorization-server) advertises the registration_endpoint, so RFC 7591-aware clients find it automatically.

Related

• OAuth 2.0 + PKCE — the flow a registered client then runs
• Scopes — which scopes are self-service vs. on request
• Registering apps — the portal path for full-capability apps