Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it on your server. Restricted keys carry only the scopes you give them.

Body

application/json

Client metadata, as RFC 7591 defines it.

client_name
string
required

Shown to the person on the authorization page.

Maximum string length: 80
client_uri
string<uri>

The client's home page, linked on the authorization page.

logo_uri
string<uri>

A square logo shown on the authorization page, PNG or SVG.

redirect_uris
string<uri>[]

Where the authorization page may send the person back. Each is an HTTPS URL, or an http://127.0.0.1 or http://[::1] loopback URL for a native app, which may use any port (RFC 8252). Required when grant_types includes authorization_code.

grant_types
enum<string>[]

The grants the client will use. client_credentials needs a secret key on the request.

Available options:
authorization_code,
refresh_token,
client_credentials
response_types
enum<string>[]

Defaults to ["code"] when grant_types includes authorization_code, and to [] otherwise.

Available options:
code
token_endpoint_auth_method
enum<string>
default:none

none for a public client, such as a desktop or command-line agent. client_secret_basic or client_secret_post for a confidential client, which needs a secret key on the request.

Available options:
none,
client_secret_basic,
client_secret_post
scope
string

Space-separated scopes the client may ask for. Defaults to every MCP scope.

software_id
string

Identifies the client software across its installations, such as a reverse domain name.

software_version
string

The version of the client software.

Response

The registered client.

A registered OAuth client, as RFC 7591 returns it.

client_id
string
required

Unique identifier for the client, cl_….

Pattern: ^cl_[0-9a-hjkmnp-tv-z]{26}$
client_id_issued_at
integer
required

Unix seconds when the client was registered.

client_name
string
required

The registered name.

redirect_uris
string<uri>[]
required

The registered redirect URIs.

grant_types
enum<string>[]
required

The grants the client may use.

Available options:
authorization_code,
refresh_token,
client_credentials
response_types
enum<string>[]
required

The response types the client may use.

Available options:
code
token_endpoint_auth_method
enum<string>
required

How the client authenticates at the token endpoint.

Available options:
none,
client_secret_basic,
client_secret_post
account
string | null
required

The account that registered a confidential client, whose licenses its License tokens draw on. null for a public client.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$
client_secret
string

A confidential client's secret, rcs_…. Shown only in this response: store it with your other secrets.

client_secret_expires_at
integer

0: the secret does not expire.

client_uri
string<uri>

The registered home page.

logo_uri
string<uri>

The registered logo.

scope
string

The scopes the client may ask for.

software_id
string

The registered software ID.

software_version
string

The registered software version.