Skip to content
AppHandoff AppHandoff Docs

RFC 7591 Dynamic Client Registration

POST
/oauth/register
 
curl --request POST \
  --url https://example.com/api/oauth/register \
  --header 'Content-Type: application/json' \
  --data '{ "redirect_uris": [ "https://example.com" ], "client_name": "example" }'

Idempotent proxy for Supabase Management API client registration.

Strict input (per RFC 7591 §2 + §3.2.2): redirect_uris is REQUIRED and must be a non-empty array. The endpoint refuses registration with invalid_redirect_uri instead of silently substituting a default.

Each redirect_uris entry must be one of:

  • https://…
  • http://localhost, http://127.0.0.1, or http://[::1] (loopback only)
  • any other RFC 3986 custom scheme (e.g. cursor://, claude://), EXCEPT javascript:, data:, file:, vbscript: (denylisted).

Request Body required

Section titled “Request Body required ”
Media type application/json
object
redirect_uris
required

Non-empty array of valid redirect URIs.

Array<string>
>= 1 items
client_name

Optional human-readable client name. Control characters are stripped.

string
<= 120 characters

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Client registered (or existing client returned for idempotent re-registration)

Media type application/json
object
client_id
string format: uuid
client_id_issued_at
integer
redirect_uris
Array<string>
client_name
string
token_endpoint_auth_method
string
Allowed values: none
grant_types
Array<string>
response_types
Array<string>

400

Section titled “400 ”

RFC 7591 error envelope ({ error, error_description }). Error codes:

  • invalid_client_metadata — body is not valid JSON
  • invalid_redirect_uri — redirect_uris missing/empty/contains invalid entry
Media type application/json
object
error
required
string
Allowed values: invalid_client_metadata invalid_redirect_uri
error_description
string

500

Section titled “500 ”

Server error

Media type application/json
object
error
required

Human-readable error message

string
code

Stable machine-readable error code for client branching

string
fieldErrors

First validation message per field path

object
key
additional properties
string
issues

Structured validation issues (Zod)

Array<object>
object
path
required
string
message
required
string
retryAfter

Seconds until rate limit resets (429 responses)

number