# Register an MCP client (RFC 7591)

> Source: https://elaichi.ai/docs/api-reference/mcp-oauth/oauth/registeroauthclient/

`POST /oauth/register`

Resource: **Oauth** · API: **MCP OAuth**

## Request body

- **`client_name`** _(string)_
  Shown on the consent screen. Defaults to "MCP client". Not verified — see `client_name` on the grant schema.
- **`redirect_uris`** _(array<string>)_
  Where authorization codes may be delivered, matched later by exact string. Accepted: any `https` URI; `http` only on loopback (`localhost`, `127.0.0.1`, `[::1]`), the RFC 8252 native-app pattern; or a private-use reverse-DNS scheme such as `com.example.app:/callback`. Fragments and wildcards are rejected.
- **`grant_types`** _(array<string>)_
  Defaults to both. Any other value is rejected.
- **`response_types`** _(array<string>)_
  Only `["code"]` is supported.
- **`token_endpoint_auth_method`** _(string)_
  Defaults to `none` (public client, PKCE only). Choosing either `client_secret_*` method issues a secret that the token and revocation endpoints will then require.
  Allowed: `none`, `client_secret_post`, `client_secret_basic`
- **`client_uri`** _(string)_
- **`logo_uri`** _(string)_
  Rendered on the consent screen beside the app name, `https:` only — an `http:`, `data:` or `blob:` value falls back to a generated monogram, as does one that fails to load. It is fetched with `referrer-policy: no-referrer` and without credentials. Note that it proves nothing: registration is unauthenticated, so this is a mark the registrant chose, exactly like `client_name`, and the consent screen says so to the user. `redirect_uris` remains the only identity signal a lookalike cannot forge.
- **`scope`** _(string)_
  Accepted and ignored; scopes are chosen per authorization.

## Response body

- **`client_id`** _(string)_
  OAuth client id (`ocli_…`).
- **`client_secret`** _(string)_
  Present only for confidential clients. Returned exactly once — store it now.
- **`client_id_issued_at`** _(integer)_
  Unix seconds.
- **`client_secret_expires_at`** _(integer)_
  `0` — the secret does not expire.
- **`client_name`** _(string)_
- **`redirect_uris`** _(array<string>)_
- **`grant_types`** _(array<string>)_
- **`response_types`** _(array<string>)_
- **`token_endpoint_auth_method`** _(string)_
- **`client_uri`** _(string)_
- **`logo_uri`** _(string)_
- **`scope`** _(string)_
  Space-delimited list of every scope this server supports.

## Code examples

### curl

```bash
curl -X POST 'https://api.elaichi.ai/oauth/register' \
  -H 'Content-Type: application/json' \
  -d '{"client_name":"your_client_name","redirect_uris":[],"grant_types":[],"response_types":[],"token_endpoint_auth_method":"none","client_uri":"your_client_uri","logo_uri":"your_logo_uri","scope":"your_scope"}'
```

### JavaScript

```javascript
const body = {
  "client_name": "your_client_name",
  "redirect_uris": [],
  "grant_types": [],
  "response_types": [],
  "token_endpoint_auth_method": "none",
  "client_uri": "your_client_uri",
  "logo_uri": "your_logo_uri",
  "scope": "your_scope"
};

const response = await fetch('https://api.elaichi.ai/oauth/register', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);
```

### Python

```python
import os
import requests

url = "https://api.elaichi.ai/oauth/register"
headers = {
    "Content-Type": "application/json",
}
payload = {
    "client_name": "your_client_name",
    "redirect_uris": [],
    "grant_types": [],
    "response_types": [],
    "token_endpoint_auth_method": "none",
    "client_uri": "your_client_uri",
    "logo_uri": "your_logo_uri",
    "scope": "your_scope"
}

response = requests.post(url, headers=headers, json=payload)
print(response.json())
```