/oauth/registerDynamic Client Registration (RFC 7591)
Open registration endpoint (advertised as `registration_endpoint` in the AS metadata). An MCP client POSTs its metadata as JSON and receives a `client_id`. **Public clients only**: `token_endpoint_auth_method` is forced to `none` (no secret — authenticate with PKCE), `scope` is forced to `mcp`, `grant_types` is filtered to `authorization_code`(+`refresh_token`) and `response_types` to `code`. `redirect_uris` (required, 1-5) must each be `https` or a loopback `http://127.0.0.1[:port]` URI with no fragment (RFC 8252; `localhost` is rejected — register the 127.0.0.1 IP literal). Guarded by per-IP + global daily caps. Returns 201 `{ client_id, client_id_issued_at, redirect_uris, grant_types, response_types, token_endpoint_auth_method, scope }` — no `client_secret` (public client).
Parameters
| Name | In | Required | Default | Allowed | Description | Example |
|---|---|---|---|---|---|---|
| redirect_uris | body | required | — | — | JSON array (1-5) of allowed redirect URIs. Each must be `https` or loopback `http://127.0.0.1[:port]`, no fragment. | http://127.0.0.1:51000/callback |
| client_name | body | optional | — | — | Human-readable client name shown on the consent page (escaped). | Cursor |
| grant_types | body | optional | authorization_code refresh_token | — | JSON array; filtered to the supported set (`authorization_code` required). | authorization_code |
| token_endpoint_auth_method | body | optional | none | — | Public clients only — must be `none` (or omitted). | none |
Response schema
| Field | Type | Nullable | Description |
|---|---|---|---|
| client_id | string | no | The newly issued client identifier. The client passes this on every subsequent `/oauth/authorize`, `/oauth/token` and `/oauth/revoke` call. There is NO `client_secret` — this is a public client. |
| client_id_issued_at | integer | no | Unix timestamp (seconds) when the client_id was issued. |
| token_endpoint_auth_method | string | no | How the client authenticates at the token endpoint. Always `none` (public client; authenticates with PKCE, no secret). |
| grant_types | array | no | The grant types registered for this client, filtered to the supported set — `authorization_code` (always present) and optionally `refresh_token`. |
| response_types | array | no | The response types registered. Always `['code']`. |
| redirect_uris | array | no | The accepted redirect URIs (as validated: 1-5 entries, each `https` or an `http://127.0.0.1[:port]` loopback with no fragment). `/oauth/authorize` accepts a `redirect_uri` only if it matches one of these. |
| scope | string | no | The scope granted to this client — the `mcp` superscope plus the read-scope set — as a space-delimited string. |
| client_name | string | yes | The human-readable client name, echoed back. Present only when the request supplied `client_name`. |
Errors
| Status | Label | Description |
|---|---|---|
| 200 | OK | Request succeeded. |
| 400 | Bad Request | Invalid query, body, or path parameter. |
| 401 | Unauthorized | Missing or invalid Authorization header / api_Token. |
| 402 | Payment Required | Insufficient token balance for this call. Top up |
| 429 | Too Many Requests | Rate limit exceeded for your tier (see /pricing for tier limits). Tier limits |
| 500 | Server Error | Unexpected server-side failure. Retry with backoff; report if persistent. |
Code samples
curl -X POST "https://api.finradar.ai/oauth/register" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"redirect_uris": "http://127.0.0.1:51000/callback",
"client_name": "Cursor",
"grant_types": "authorization_code",
"token_endpoint_auth_method": "none"
}'Generate an API key in /account/credentials to run live queries (literal YOUR_API_KEY placeholder shown until then).