Register a short-lived public OAuth client for interactive Admin MCP access.

POST

/oauth/admin-agent/register

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/oauth/admin-agent/register \
  --header 'Content-Type: application/json' \
  --data '{ "redirect_uris": [ "http://127.0.0.1:49152/callback/random-id" ], "client_name": "Codex", "grant_types": [ "authorization_code", "refresh_token" ], "response_types": [ "code" ], "token_endpoint_auth_method": "none", "scope": "agent:read agent:user-data:read agent:write" }'

Restricted RFC 7591 profile used by MCP hosts. No Initial Access Token is required. The endpoint accepts only public Authorization Code clients with PKCE, exact redirect URIs, and the three interactive Agent scopes. It never returns a client secret, cannot request trusted or skip-consent behavior, and does not issue an RFC 7592 registration management token. It is tenant scoped, rate limited, and expires after 30 days of inactivity.

Request Body ^required

Media type application/json

object

redirect_uris

required

Required and non-empty for redirect-based grants; omitted or empty for CIBA-only clients.

Array<string>

<= 10 items unique items

client_name

string

>= 1 characters <= 100 characters

grant_types

Array<string>

unique items

Allowed values: authorization_code refresh_token

response_types

Array<string>

unique items

token_endpoint_auth_method

string

Allowed value: none

scope

Space-separated subset of agent:read, agent:user-data:read, and agent:write. If present, agent:read is required. If omitted, the server registers all three as requestable ceilings; the Admin still selects the granted subset on the consent screen.

string

dpop_bound_access_tokens

Optional request for sender-constrained tokens when the MCP host supports DPoP.

boolean

key

additional properties

Example

{
  "redirect_uris": [
    "http://127.0.0.1:49152/callback/random-id"
  ],
  "client_name": "Codex",
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": [
    "code"
  ],
  "token_endpoint_auth_method": "none",
  "scope": "agent:read agent:user-data:read agent:write"
}

Responses

201

Restricted public Agent client registration without any secret.

Media type application/json

object

client_id

required

string

client_id_issued_at

required

integer

redirect_uris

required

Array<string>

grant_types

required

Array<string>

response_types

required

Array<string>

token_endpoint_auth_method

required

string

Allowed value: none

scope

required

string

require_pkce

required

boolean

dpop_bound_access_tokens

boolean

key

additional properties

Example

{
  "token_endpoint_auth_method": "none",
  "require_pkce": true
}

400

OAuth error response.

Media type application/json

object

error

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

403

OAuth error response.

Media type application/json

object

error

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

429

OAuth error response.

Media type application/json

object

error

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

503

OAuth error response.

Media type application/json

object

error

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example"
}