Skip to main content

Dynamic Client Registration

AIGW exposes Dynamic Client Registration at:

POST https://api.aigw.eval.loginid.ai/api/register

Example request​

{
  "client_name": "My agent",
  "redirect_uris": ["https://agent.example.com/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "client_secret_post"
}

Observed constraints​

  • Redirect URI must be absolute HTTPS.
  • The supplied playground intentionally omits scope during DCRDCRDynamic Client Registration (RFC 7591): an agent registers itself as an OAuth client at runtime, with no manual setup. because non-registrable scopes can reject the whole request.
  • ResourceResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays. scopes are requested later at authorization time.

Response​

The supplied run received 201 with a client ID, client secret, granted default scopes, domain, verification method, and core endpoint metadata.

One subtlety: the DCR response returned a core authorization endpoint while the actual resource-specific authorization flow used the per-resource /oauth2/auth endpoint. The agent implementation in the supplied playground uses the Resource authorization server discovered from protected-resource metadata.