OAuth 2.0 Dynamic Client Registration
OAuth 2.0 Dynamic Client Registration, defined in RFC 7591, lets a client obtain its own client ID, and optionally a client secret, by posting its metadata -- redirect URIs, client name, requested grant types -- directly to an authorization server's registration endpoint, instead of a developer manually registering it through that server's portal ahead of time. This matters specifically for MCP, where a general-purpose client is expected to connect to servers, and their authorization servers, it has never encountered before; requiring every server operator and client developer to coordinate credentials in advance doesn't scale to that many unplanned pairings, which is why the MCP authorization specification requires servers to support dynamic registration rather than assuming out-of-band setup. An authorization server can still require an initial access token to gate who's allowed to register, or a signed software statement vouching for the client's metadata -- dynamic registration means the step doesn't require a human in the loop, not that it's unauthenticated.
By AdminKit team, Netbase JSC · Updated