Register an OAuth client

curl --request POST \ --url https://api.panoflow.io/v1/oauth/register \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data ' { "client_name": "Claude", "redirect_uris": [ "https://claude.ai/api/mcp/auth_callback" ], "grant_types": [ "authorization_code", "refresh_token" ], "response_types": [ "code" ], "token_endpoint_auth_method": "none", "logo_uri": "https://claude.ai/images/claude-logo.png" } '

{ "client_id": "cli_01JB8QGXJY8230B0ARNFJD2WEX", "client_id_issued_at": 1791970800, "client_name": "Claude", "redirect_uris": [ "https://claude.ai/api/mcp/auth_callback" ], "grant_types": [ "authorization_code", "refresh_token" ], "response_types": [ "code" ], "token_endpoint_auth_method": "none", "logo_uri": "https://claude.ai/images/claude-logo.png" }

{ "error": { "response_code": "00", "type": "invalid_request", "code": "invalid_json", "message": "<string>", "request_id": "<string>", "param": "<string>", "doc_url": "<string>", "details": {} } }

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-Request-Id

string

Optional client correlation id, up to 128 characters. It is not echoed: the response's X-Request-Id is always our own req_… id. We log your value with the request as client_request_id, so support can find a request by either id. A longer value is refused with 400 parameter_invalid.

Maximum string length: 128

Body

application/json

RFC 7591 registration. Clients register themselves (no keys to copy). Only public clients with PKCE are accepted.

client_name

string

required

Shown on the consent page and in "Connected apps".

Required string length: 1 - 80

redirect_uris

string<uri>[]

required

Exact redirect URIs. Each must be https://, or http://localhost / http://127.0.0.1 with any port (native and CLI clients).

Required array length: 1 - 10 elements

grant_types

enum<string>[]

Defaults to both.

Available options:

authorization_code,

refresh_token

response_types

enum<string>[]

Defaults to ["code"].

Available options:

code

token_endpoint_auth_method

enum<string>

default:none

Must be none.

Available options:

none

client_uri

string<uri>

Client home page.

logo_uri

string<uri>

Logo shown on the consent page (https only).

scope

string

Space-separated scopes the client may later request.

software_id

string

Client software identifier.

Maximum string length: 200

software_version

string

Client software version.

Maximum string length: 50

Response

Client registered.

A registered OAuth client (RFC 7591 response).

client_id

string

required

Client id.

Pattern: ^cli_[0-9A-HJKMNP-TV-Z]{26}$

client_id_issued_at

integer

required

Unix seconds.

client_name

string

required

Client name.

redirect_uris

string<uri>[]

required

Registered redirect URIs.

grant_types

string[]

required

Grants.

response_types

string[]

required

Response types.

token_endpoint_auth_method

string

required

Always none.

Allowed value: "none"

client_uri

string<uri>

Home page.

logo_uri

string<uri>

Logo.

scope

string

Scopes registered.

Accounts & transactions

Payments

Collections

Payroll

Approvals

Webhooks & events

OAuth

Register an OAuth client

Authorizations

Headers

Body

Response