Register an app without a card

RFC 7591, open: an app no card answers for. The consent page calls it unverified, and it is gone 30 days after registration.

POST/oidc/register

Access: Creates temporary data
Client: Local or server client

JSON body#

Name	Location	Meaning
`redirect_uris`Required	JSON	1 to 10: https, or http on the loopback interface.
`client_name`Required	JSON	1 to 60 characters; it may not say Veil.
`token_endpoint_auth_method`	JSON	client_secret_basic (default), private_key_jwt or none.
`grant_types, response_types`	JSON	authorization_code (and refresh_token); code.
`id_token_signed_response_alg`	JSON	EdDSA (default) or ES256.
`jwks`	JSON	With private_key_jwt: 1 to 8 public keys. jwks_uri and logo_uri are not read.

Request examples#

cURL

curl -fsS --json '{"client_name":"CLI notes","redirect_uris":["http://127.0.0.1/callback"],"token_endpoint_auth_method":"none"}' 'https://veil.rip/oidc/register'

Response#

HTTP 201application/json

201 with the metadata kept, and client_secret once.

Field	Type	Meaning
`client_id`	`string`	veil_app_ and 32 hex characters.
`client_secret`	`string`	For client_secret_basic, once.
`client_id_issued_at, client_secret_expires_at, veil_expires_at`	`integer`	Unix seconds; the app ends at veil_expires_at.
`redirect_uris, client_name, client_uri, token_endpoint_auth_method, grant_types, response_types, id_token_signed_response_alg, post_logout_redirect_uris, jwks, application_type, scope`	`mixed`	The metadata as kept.

Response headers#

Header	Value	Meaning
`Content-Type`	`application/json`	JSON, also for errors.
`Cache-Control`	`no-store`	Private: never cached.

Usage notes#

Errors of this endpoint follow OAuth: {"error", "error_description"} (RFC 6749, 5.2), not the error object of the rest of the API. A rate limit still answers 429 with the usual envelope.
Ten registrations an hour per IP.

Errors#

API errors return an error object. Use error.code for program logic; error.message is English text for people and can change. Response and error guide

HTTP	Code	Meaning and next step
400	`invalid_client_metadata`	OAuth error: a registration field is missing or not allowed (name, site, grant types, response types, the ID token algorithm, jwks). Read `error_description` and fix that field.
400	`invalid_redirect_uri`	OAuth error: a redirect URI is not https, or http outside the loopback interface, or has a fragment or user information. Register exact https URIs, or http://127.0.0.1/… for a native app.
404	`invalid_request`	OAuth error: Sign in with Veil is not configured on this server. Use https://veil.rip, or a server whose discovery document answers.
503	`temporarily_unavailable`	OAuth error: too many apps are registered without a card right now. Register the app from /developers, with a card.

Shared request errors

HTTP Code Meaning and next step

429

HTTP	Code	Meaning and next step
429	`rate_limited`	An anonymous, signed-request or API-key allowance was exceeded. Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.
500	`internal_error`	An unexpected server error occurred. Internal details are not returned. Retry reads with bounded backoff. Check write results before sending a new signed operation.
503	`busy`	The application has reached a temporary concurrency or database limit. Wait `Retry-After` seconds and retry with bounded backoff.

rate_limited

An anonymous, signed-request or API-key allowance was exceeded.

Wait at least Retry-After seconds. Share a queue and retry budget across your workers.

500

internal_error

An unexpected server error occurred. Internal details are not returned.

Retry reads with bounded backoff. Check write results before sending a new signed operation.

503

busy

The application has reached a temporary concurrency or database limit.

Wait Retry-After seconds and retry with bounded backoff.

Read this entry as JSON