Replace a dynamically registered client.
curl --request PUT \ --url https://auth.example.com/clients/example \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "redirect_uris": [ "https://app.example.com/callback" ], "client_name": "Example App", "grant_types": [ "authorization_code", "refresh_token" ], "response_types": [ "code" ], "scope": "openid profile email", "require_pkce": true }'Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”Request Body required
Section titled “Request Body required ”object
Omitted means the tenant’s ID token algorithm (RS256 unless the tenant chose another; the registration response then names it). Refused (400 invalid_client_metadata) when it differs from the tenant’s algorithm while the tenant does not let apps choose; 503 temporarily_unavailable when that policy cannot be read.
JWS algorithm used for JWT-secured authorization responses (JARM).
JWE key-management algorithm used to encrypt JARM responses.
JWE content-encryption algorithm used to encrypt JARM responses.
Must be true when grant_types contains client_credentials.
Audience of the app’s access tokens when a token request names none. When neither this nor default_resource is sent, an app with the authorization code grant gets the tenant’s issuer URL as its default resource. An app that registers without it but with a grant that uses a default target gets the tenant’s dcr.default_audience / dcr.default_resource when the tenant has set them (copied at registration, so a later change does not retarget the app). Dynamic registration currently registers client credentials and CIBA apps from that set; device and token exchange apps are created through the admin API, which does not copy this default. Any other app (implicit or refresh token only) has no default target. The tenant’s default cannot be an issuer URL of the tenant or its /userinfo URL: every issuer host the tenant’s host and identifier policy allows is reserved, whether or not a custom domain or lookup routes it today.
Resource indicator (RFC 8707) of the app’s access tokens when a token request names none. See default_audience for the default an app gets when it sends neither.
object
Example
{ "redirect_uris": [ "https://app.example.com/callback" ], "client_name": "Example App", "grant_types": [ "authorization_code", "refresh_token" ], "response_types": [ "code" ], "scope": "openid profile email", "require_pkce": true}Responses
Section titled “ Responses ”Successful JSON response.
object
Present when the app sent it, or when the app was given the tenant’s dcr.default_audience.
Present when the app sent it, or when the app was given the tenant’s dcr.default_resource. Not present for the issuer URL an authorization code app gets by default.
The algorithm the app’s ID Tokens are signed with (named when not RS256, even if the app registered none).
Example
{ "client_id": "client_123", "client_secret": "secret_123", "client_id_issued_at": 1770000000, "client_secret_expires_at": 0, "registration_access_token": "reg_access_123", "registration_client_uri": "https://auth.example.com/clients/client_123", "redirect_uris": [ "https://app.example.com/callback" ], "require_pkce": true}OAuth error response.
object
Example generated
{ "error": "example", "error_description": "example"}