Skip to main content
curl --request POST \
  --url https://${projectDomain}/v1/oauth2/register \
  -H 'Content-Type: application/json' \
  -d '{
    "client_name": "Dynamically registered client",
    "client_uri": "https://client.example.com/about",
    "redirect_uris": ["http://localhost:3000/oauth2/callback"]
  }'

{
  "client_id": "connected-app-test-f1877bf2-d660-4675-b82d-b5fe91a609fa",
  "client_name": "Dynamically registered client",
  "grant_types": ["authorization_code", "refresh_token"],
  "redirect_uris": ["http://localhost:3000/oauth2/callback"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none"
}
POST
https://${projectdomain}
/
v1
/
oauth2
/
register
curl --request POST \
  --url https://${projectDomain}/v1/oauth2/register \
  -H 'Content-Type: application/json' \
  -d '{
    "client_name": "Dynamically registered client",
    "client_uri": "https://client.example.com/about",
    "redirect_uris": ["http://localhost:3000/oauth2/callback"]
  }'

{
  "client_id": "connected-app-test-f1877bf2-d660-4675-b82d-b5fe91a609fa",
  "client_name": "Dynamically registered client",
  "grant_types": ["authorization_code", "refresh_token"],
  "redirect_uris": ["http://localhost:3000/oauth2/callback"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none"
}
Register a new OAuth 2.0 client dynamically with Stytch. This endpoint allows client applications to register themselves without requiring manual configuration through the Dashboard. This endpoint uses your Custom Domain. This feature must be enabled at the project level in the Connected Apps section of the Dashboard. This endpoint creates a Third-Party Public or Third-Party Confidential Connected App client, depending on the authentication method specified. Public clients with identical metadata may return the same client ID (see Client Deduplication below), while confidential clients always receive a unique client ID. No authorization is needed for this endpoint. This endpoint implements the OpenID Connect Dynamic Client Registration specification and is compatible with the OAuth 2.0 Dynamic Client Registration specification.

​
Client Deduplication

To prevent duplicate public clients, Stytch computes a hash of the submitted client metadata. If the metadata matches an existing public client exactly, the same client ID is returned instead of creating a new one. This ensures that multiple instances of the same application (like MCP clients) can be administered as a single client identity.
Deduplication only applies to public clients (those using token_endpoint_auth_method: "none"). Confidential clients always receive a unique client ID and client secret.

​
Client Types and Authentication

Both third_party_public and third_party_confidential clients can be created through dynamic registration:
  • third_party_public: Set token_endpoint_auth_method to none. These clients do not receive a client secret and must use PKCE for all authorization flows.
  • third_party_confidential: Set token_endpoint_auth_method to client_secret_post or client_secret_basic. These clients receive a client secret for authentication.
All dynamically registered clients will have:
  • grant_types: ["authorization_code", "refresh_token"]
  • response_types: ["code"]
We recommend using the Custom Domain whenever possible. For backwards compatibility reasons, this endpoint is also available at https://test.stytch.com/v1/public/${projectId}/oauth2/register.

​
Body

​
redirect_uris
array
required
Array of redirect URI values for use in OAuth Authorization flows.
​
client_name
string
A human-readable name for the client.
​
client_uri
string
URL of the home page of the Client.
​
token_endpoint_auth_method
string
Authentication method used by the client for the token endpoint. Must be one of none, client_secret_post, or client_secret_basic.

​
Response

​
client_id
string
The ID of the Connected App client.
​
client_uri
string
URL of the home page of the Client.
​
client_name
string
A human-readable name for the client.
​
grant_types
array
Array of OAuth 2.0 grant types that the client may use.
​
redirect_uris
array
Array of redirect URI values for use in OAuth Authorization flows.
​
response_types
array
Array of OAuth 2.0 response types that the client may use.
​
token_endpoint_auth_method
string
Authentication method used by the client for the token endpoint. Must be one of none, client_secret_post, or client_secret_basic.
​
request_id
string
Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
​
status_code
number
The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.