OAuth2 dynamic client registration

POST/oauth/register

No scope required

Registers an OAuth2 client (RFC 7591) for the authorization code flow. Returns the client_id and, when token_endpoint_auth_method is client_secret_post, a one-time client_secret. IP-throttled.

This endpoint is unauthenticated and carries no scope.

Request body

application/json, required

client_namestringRequired#
redirect_urisstring (uri)[]Required#
token_endpoint_auth_methodstring#
One of: none, client_secret_postDefault: "none"

{
  "client_name": "string",
  "redirect_uris": [
    "https://example.com"
  ],
  "token_endpoint_auth_method": "none"
}

Responses

200

An existing public (token_endpoint_auth_method: none) client with the same client_name and redirect_uris was reused. No client_secret is returned.

{
  "client_id": "string",
  "client_name": "string",
  "redirect_uris": [
    "string"
  ],
  "grant_types": [
    "string"
  ],
  "token_endpoint_auth_method": "string"
}

201

Client registered.

{
  "client_id": "string",
  "client_secret": "string",
  "client_name": "string",
  "redirect_uris": [
    "string"
  ],
  "grant_types": [
    "string"
  ],
  "token_endpoint_auth_method": "string"
}

422

Request validation failed (HTTP 422). The body is either the Laravel validation envelope (message + field-keyed errors) or the API error envelope for domain rejections (e.g. form_type_not_supported, folder_locked, parent_not_found, folder_not_empty).

429

Too many registrations (slow_down), with Retry-After.

OAuthError

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/oauth/register\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "client_name": "string",
  "redirect_uris": [
    "https://example.com"
  ],
  "token_endpoint_auth_method": "none"
}'