Client registration

Dynamic Client Registration (RFC 7591). Anonymous by design (as required by the MCP authorization spec): the guard rails are on the metadata — https (or loopback) redirect URIs, authorization code grant only, a fixed set of scopes. Self-registered clients are always treated as third-party: the user approves them on a consent screen. Self-registered clients see the consent screen the first time, and again whenever the person has no valid token of that client covering the requested scopes; send prompt=consent to always show it.

Base URL, authentication and conventions of this API are on the OAuth & OpenID Connect API page.

Endpoints

post/oauth/registerRegister an OAuth client dynamically
options/oauth/registerCORS preflight for client registration

post/oauth/register

Register an OAuth client dynamically

RFC 7591 Dynamic Client Registration. No authentication: any client can register, the user's consent is what protects the account.

Rules applied to the metadata:

redirect_uris is required, 1 to 5 absolute URIs, https only — http is accepted only for loopback hosts (localhost, 127.0.0.1, [::1], RFC 8252). No fragment, no *. Duplicates are removed.
grant_types defaults to ["authorization_code"]; only authorization_code and refresh_token are accepted and authorization_code must be present. refresh_token is always added.
response_types may only contain code.
token_endpoint_auth_method defaults to none (public client + PKCE, as MCP connectors work). client_secret_post or client_secret_basic make it a confidential client and the response includes a client_secret that never expires — it is shown only once.
scope is filtered (not rejected) to the supported set; when nothing valid is requested you get all of them. nucleo.ai_tools is always added.
client_name is stripped of HTML and cut to 120 characters (default: the host of the first redirect URI); client_uri is cut to 250 characters. Other RFC 7591 fields are ignored.

Every call creates a new client (not idempotent). Clients registered here are third-party and their tokens are limited to the AI tools (nucleo.ai_tools). Self-registered clients see the consent screen the first time, and again whenever the person has no valid token of that client covering the requested scopes; send prompt=consent to always show it.

Rate limit: 10 requests per minute per IP address. Over the limit the answer is 429 with a JSON OAuth error (error: rate_limited), Retry-After and the CORS headers of the other responses.

POST https://auth.nucleoplatform.com/oauth/register

Authentication: None — public endpoint

Rate limit: 10 requests per 1m, per IP

Request bodyapplication/json

redirect_urisarray of string (uri)required
https, or http on loopback only. No fragment, no wildcard.

min items 1max items 5
client_namestring
Shown on the consent screen. HTML is stripped.

max length 120
client_uristring (uri)
max length 250
grant_typesarray of string
One ofauthorization_coderefresh_token
default ["authorization_code"]
response_typesarray of string
One ofcode
default ["code"]
token_endpoint_auth_methodstring
One ofnoneclient_secret_postclient_secret_basic
default none
scopestring
Space-separated; filtered to the supported scopes.

default openid profile email

Responses

201Client created.application/json
Headers
- Access-Control-Allow-Origin
- client_idstringrequired
- client_id_issued_atintegerrequired
  Unix timestamp.
- client_secretstring
  Confidential clients only. Shown once.
- client_secret_expires_atinteger
  0 = never expires.
  
  One of0
- client_namestring
- redirect_urisarray of string (uri)required
- grant_typesarray of stringrequired
- response_typesarray of stringrequired
- token_endpoint_auth_methodstringrequired
- scopestringrequired
400Invalid client metadata (RFC 7591 §3.2.2 error response).application/json
Headers
- Access-Control-Allow-Origin
- errorstringrequired
  One ofinvalid_redirect_uriinvalid_client_metadata
- error_descriptionstring
429Rate limit exceeded. JSON OAuth error (RFC 6749 §5.2 format), whatever the Accept header.application/json
Headers
- Retry-After
- X-RateLimit-Limit
- X-RateLimit-Remaining
- errorstringrequired
  One ofrate_limited
- error_descriptionstring

Request

curl -X POST https://auth.nucleoplatform.com/oauth/register \
  -H 'Content-Type: application/json' \
  -d '{
  "client_name": "Acme Assistant",
  "redirect_uris": [
    "https://assistant.acme.example/oauth/callback"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": [
    "code"
  ],
  "token_endpoint_auth_method": "none",
  "scope": "openid profile email offline_access"
}'

const res = await fetch("https://auth.nucleoplatform.com/oauth/register", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "client_name": "Acme Assistant",
    "redirect_uris": [
      "https://assistant.acme.example/oauth/callback"
    ],
    "grant_types": [
      "authorization_code",
      "refresh_token"
    ],
    "response_types": [
      "code"
    ],
    "token_endpoint_auth_method": "none",
    "scope": "openid profile email offline_access"
  }),
});
const data = await res.json();
console.log(res.status, data);

<?php

require 'vendor/autoload.php';

$client = new GuzzleHttp\Client();

$response = $client->request('POST', 'https://auth.nucleoplatform.com/oauth/register', [
    'json' => [
        'client_name' => 'Acme Assistant',
        'redirect_uris' => [
            'https://assistant.acme.example/oauth/callback',
        ],
        'grant_types' => [
            'authorization_code',
            'refresh_token',
        ],
        'response_types' => [
            'code',
        ],
        'token_endpoint_auth_method' => 'none',
        'scope' => 'openid profile email offline_access',
    ],
    'http_errors' => false,
]);

echo $response->getStatusCode(), PHP_EOL;
echo $response->getBody();

Response

{
  "client_id": "9d3f2b1c-6a4e-4f7b-9c2d-1e8a7b6c5d4f",
  "client_id_issued_at": 1791100800,
  "client_name": "Acme Assistant",
  "redirect_uris": [
    "https://assistant.acme.example/oauth/callback"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": [
    "code"
  ],
  "token_endpoint_auth_method": "none",
  "scope": "openid profile email offline_access nucleo.ai_tools"
}

{
  "client_id": "9d3f2b1c-7b5f-4a8c-8d3e-2f9b8c7d6e5a",
  "client_id_issued_at": 1791100800,
  "client_secret": "s3cr3tExampleValueOnlyShownOnce000000000",
  "client_secret_expires_at": 0,
  "client_name": "Acme Reporting",
  "redirect_uris": [
    "https://reports.acme.example/auth/nucleo/callback"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": [
    "code"
  ],
  "token_endpoint_auth_method": "client_secret_basic",
  "scope": "openid email nucleo.ai_tools"
}

{
  "error": "invalid_redirect_uri",
  "error_description": "redirect_uris is required and must be a non-empty array."
}

{
  "error": "invalid_redirect_uri",
  "error_description": "Too many redirect_uris (max 5)."
}

{
  "error": "invalid_redirect_uri",
  "error_description": "redirect_uris must use https (http is allowed only for loopback addresses)."
}

{
  "error": "invalid_redirect_uri",
  "error_description": "redirect_uris must not contain a fragment."
}

{
  "error": "invalid_redirect_uri",
  "error_description": "Wildcards are not allowed in redirect_uris."
}

{
  "error": "invalid_client_metadata",
  "error_description": "Unsupported grant_types: client_credentials. Only authorization_code and refresh_token are supported."
}

{
  "error": "invalid_client_metadata",
  "error_description": "Only the \"code\" response_type is supported."
}

{
  "error": "invalid_client_metadata",
  "error_description": "Unsupported token_endpoint_auth_method."
}

{
  "error": "rate_limited",
  "error_description": "Too many requests. Retry after 42 seconds."
}

options/oauth/register

CORS preflight for client registration

Lets browser-based clients register themselves. Always answers 204 with permissive CORS headers.

OPTIONS https://auth.nucleoplatform.com/oauth/register

Authentication: None — public endpoint

Responses

204Preflight accepted.
Headers
- Access-Control-Allow-Origin
- Access-Control-Allow-Methods
- Access-Control-Allow-Headers

Request

curl -X OPTIONS https://auth.nucleoplatform.com/oauth/register

const res = await fetch("https://auth.nucleoplatform.com/oauth/register", {
  method: "OPTIONS",
});
const data = await res.json();
console.log(res.status, data);

<?php

require 'vendor/autoload.php';

$client = new GuzzleHttp\Client();

$response = $client->request('OPTIONS', 'https://auth.nucleoplatform.com/oauth/register', [
    'http_errors' => false,
]);

echo $response->getStatusCode(), PHP_EOL;
echo $response->getBody();

Response

HTTP 204 — Preflight accepted.

Was this page helpful?