OAuth Clients

When a server uses ezforge_managed auth, client applications must register as OAuth clients before they can request tokens. This follows RFC 7591 (Dynamic Client Registration). Required scope: Session authentication only.

List OAuth clients

GET /v1/servers/:serverId/clients

Returns all registered OAuth clients for the server. Response 200:

{
  "data": [
    {
      "id": "oac_abc123",
      "clientId": "client_xyz...",
      "name": "My MCP Client",
      "redirectUris": ["https://myapp.example.com/callback"],
      "scopes": ["mcp:read"],
      "isDynamic": false,
      "createdAt": "2026-01-15T10:00:00Z"
    }
  ]
}

Register OAuth client

POST /v1/servers/:serverId/clients

Registers a new OAuth client for the server. Request body:

{
  "name": "My MCP Client",
  "redirectUris": ["https://myapp.example.com/callback"],
  "scopes": ["mcp:read"]
}

Field	Type	Required	Description
`name`	string	✓	Human-readable client name (max 255 chars)
`redirectUris`	string[]	✓	One or more redirect URIs. Must use `https` except for loopback addresses (`localhost`, `127.0.0.1`, `[::1]`). No fragment component (RFC 6749 §3.1.2). Max 20 entries.
`scopes`	string[]	—	Requested scopes. Defaults to `["mcp:read"]` if omitted.

Response 201:

{
  "data": {
    "id": "oac_abc123",
    "clientId": "client_xyz...",
    "clientSecret": "secret_...",
    "name": "My MCP Client",
    "redirectUris": ["https://myapp.example.com/callback"],
    "scopes": ["mcp:read"],
    "isDynamic": false,
    "createdAt": "2026-01-15T10:00:00Z"
  }
}

The clientSecret is only returned once at registration time. Store it securely — it cannot be retrieved again.

Delete OAuth client

DELETE /v1/servers/:serverId/clients/:clientId

Revokes the client registration. Any tokens previously issued to this client remain valid until they expire. Response 204: No content.

API Reference

Ready

List OAuth clients

Register OAuth client

Delete OAuth client

​List OAuth clients

​Register OAuth client

​Delete OAuth client

List OAuth clients

Register OAuth client

Delete OAuth client