Register a client

POST/oauth/register

Registers an OAuth client (RFC 7591 dynamic client registration) and returns its client_id. MCP clients call it once per install, before their first authorization, so nobody has to create an app by hand.

Scope	Heavy call	Long poll	CLI
None, no key	No	No	None

Guidance

It lives at the root of https://api.chartnaut.com, not under /v1.
Every client is public. Whatever token_endpoint_auth_method you ask for, the answer says none: there is no client secret, and PKCE protects the code instead.
Keep the client_id. It does not expire. Registering again makes a new client, and a new row under Connected apps once the person approves it.
client_name is what the consent page and Connected apps show. People also see the redirect host beside it, so a misleading name does not hide where the code goes.
Limited to 20 registrations an hour from one IP address.

Request body

JSON, up to 16 KB. Unknown fields are ignored.

Field	Type	Required	Description
`redirect_uris`	array of string	Yes	1 to 10, up to 2,000 characters each. Each is `https`, `http` on `localhost` or a loopback address (any port), or a private-use scheme for a desktop app, such as `cursor://`. No fragment and no user name or password in the URI. Schemes such as `javascript`, `data` and `file` are refused
`client_name`	string	No	Up to 100 characters. Defaults to the first redirect URI's host
`client_uri`	string	No	An `https` URL for the app's home page
`logo_uri`	string	No	An `https` URL. Stored, but the consent page does not show it
`grant_types`	array of string	No	`authorization_code` and `refresh_token`. Default both
`response_types`	array of string	No	`code`. The default
`token_endpoint_auth_method`	string	No	Always answered as `none`
`scope`	string	No	Space-separated scopes. Default all three

Response

201 with the registered client:

Field	Type	Description
`client_id`	string	`cnc_` and 32 hex characters
`client_id_issued_at`	integer	Unix seconds
`client_name`	string	As stored
`redirect_uris`	array of string	As registered
`grant_types`	array of string	As accepted
`response_types`	array of string	`code`
`token_endpoint_auth_method`	string	`none`
`scope`	string	Space-separated scopes
`client_uri`, `logo_uri`	string	Present when sent

Errors use OAuth's shape, {"error": "...", "error_description": "..."}, not the API's envelope.

Status codes

Status	Code	Meaning
`201`	-	The client is registered
`400`	`invalid_redirect_uri`	No redirect URI, too many, or one Chartnaut does not accept
`400`	`invalid_client_metadata`	The body is not a JSON object, or a field is invalid
`429`	`temporarily_unavailable`	More than 20 registrations in an hour from your IP address
`500`	`server_error`	The client could not be stored. Retry

Example request

curl https://api.chartnaut.com/oauth/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "My research assistant",
    "redirect_uris": ["http://127.0.0.1:33418/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "token_endpoint_auth_method": "none"
  }'

Example response

201 Created

{
  "client_id": "cnc_5f2a9c0e7b3d41a8e6c19f04b7d2a3e1",
  "client_id_issued_at": 1790500000,
  "client_name": "My research assistant",
  "redirect_uris": ["http://127.0.0.1:33418/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none",
  "scope": "scripts:read scripts:write runs:write"
}

400 Bad Request

{
  "error": "invalid_redirect_uri",
  "error_description": "http redirect_uris are allowed only on localhost or 127.0.0.1; use https"
}

From the CLI

There is no CLI command for this endpoint.