oauth.net
Dynamic Client Registration
Dynamic Client Registration lets OAuth clients register themselves programmatically — submitting their metadata and receiving a client_id (and optionally a client_secret) without any manual setup by the authorization server operator.
Warning
Open Dynamic Client Registration has inherent problems. When anyone can register, the authorization server has no way to verify the metadata a client submits, so a client can claim any name or logo. Every installation of an app gets a different
client_id, so the server can't identify, set policy for, or revoke a piece of software as a whole, and it accumulates registrations it can never safely clean up. Dynamic Client Registration is only practical when the registration endpoint is protected by an initial access token, so that only approved parties can register clients. For clients that need to work without prior registration, consider Client ID Metadata Documents instead.
The client POSTs its metadata (redirect URIs, application name, logo URL, token endpoint auth method, etc.) to the registration endpoint and receives a client registration response including a client_id, and for confidential clients a client_secret. This spec was derived from the OpenID Connect Dynamic Client Registration spec and is compatible with OpenID Connect servers.
Related specs
- Dynamic Client Management RFC 7592 — updating registered clients
- Authorization Server Metadata RFC 8414 — discovering the registration endpoint
- Client ID Metadata Document — an alternative where the client identifies itself with a URL and needs no registration step
More resources
- From Self-Asserted to Domain-Backed: Why CIMD Beats DCR (Jul 2026, aaronparecki.com)