Register an OAuth client

POST

/api/oauth/register

RFC 7591 Dynamic Client Registration. Public and unauthenticated by
design: this is how a new MCP client (Claude, ChatGPT, an IDE agent,
or any other OAuth-speaking connector) gets a client_id before it has
ever talked to a real user.

Every client registered here is public and untrusted: no
client_secret is ever issued (token_endpoint_auth_method is always
none, the only value this server accepts), and the /oauth/authorize
consent screen always runs for it, every time. Rate-limited to 10
registrations per hour per IP.

Request

Authorization

API Key

Add parameter in header

x-api-key

Example:

x-api-key: ********************

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/jsonRequired

Examples

Responses

🟢201Created

application/json

Client registered.

Bodyapplication/json

🟠400Bad Request

🟠429

🔴500Server Error

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://upload.tf/api/v1/api/oauth/register' \
--header 'x-api-key: <api-key>' \
--header 'Content-Type: application/json' \
--data '{
    "client_name": "string",
    "redirect_uris": [
        "http://example.com"
    ],
    "scope": "string",
    "grant_types": [
        "authorization_code"
    ],
    "response_types": [
        "code"
    ],
    "token_endpoint_auth_method": "none"
}'

Response Example

201 - Example 1

{
    "client_id": "d1e2f3a4-5b6c-7d8e-9f0a-1b2c3d4e5f6a",
    "client_id_issued_at": 0,
    "client_name": "string",
    "redirect_uris": [
        "http://example.com"
    ],
    "grant_types": [
        "string"
    ],
    "response_types": [
        "string"
    ],
    "token_endpoint_auth_method": "none",
    "scope": "string"
}

Modified at 2026-08-07 15:42:15

Protected resource metadata (RFC 9728 §3.1 path-insertion form)

Authorization endpoint (consent screen)