{"revision":"9f11a31dd2951db0","language":"en","entry":{"id":"oidc-register","kind":"endpoint","group":"oidc","title":"Register an app without a card","method":"POST","path":"/oidc/register","paths":[],"summary":"RFC 7591, open: an app no card answers for. The consent page calls it unverified, and it is gone 30 days after registration.","response":"201 with the metadata kept, and client_secret once.","parameters":[],"sample":"/oidc/register","access":"public-write","base":"directory","notes":["Errors of this endpoint follow OAuth: `{\"error\", \"error_description\"}` (RFC 6749, 5.2), not the `error` object of the rest of the API. A rate limit still answers 429 with the usual envelope.","Ten registrations an hour per IP."],"errors":["400 invalid_client_metadata","400 invalid_redirect_uri","404 invalid_request","429 rate_limited","500 internal_error","503 busy","503 temporarily_unavailable"],"related":["sign-in-with-veil"],"sections":[{"kind":"code","language":"shell","code":"curl -fsS --json '{\"client_name\":\"CLI notes\",\"redirect_uris\":[\"http://127.0.0.1/callback\"],\"token_endpoint_auth_method\":\"none\"}' 'https://veil.rip/oidc/register'"}],"live":false,"responses":[{"status":201,"contentType":"application/json","description":"201 with the metadata kept, and client_secret once.","fields":[{"name":"client_id","type":"string","description":"veil_app_ and 32 hex characters."},{"name":"client_secret","type":"string","description":"For client_secret_basic, once."},{"name":"client_id_issued_at, client_secret_expires_at, veil_expires_at","type":"integer","description":"Unix seconds; the app ends at veil_expires_at."},{"name":"redirect_uris, client_name, client_uri, token_endpoint_auth_method, grant_types, response_types, id_token_signed_response_alg, post_logout_redirect_uris, jwks, application_type, scope","type":"mixed","description":"The metadata as kept."}]}],"responseObjects":[],"errorFormat":"json","errorDetails":[{"status":400,"code":"invalid_client_metadata","description":"OAuth error: a registration field is missing or not allowed (name, site, grant types, response types, the ID token algorithm, jwks).","action":"Read `error_description` and fix that field.","scope":"endpoint"},{"status":400,"code":"invalid_redirect_uri","description":"OAuth error: a redirect URI is not https, or http outside the loopback interface, or has a fragment or user information.","action":"Register exact https URIs, or http://127.0.0.1/… for a native app.","scope":"endpoint"},{"status":404,"code":"invalid_request","description":"OAuth error: Sign in with Veil is not configured on this server.","action":"Use https://veil.rip, or a server whose discovery document answers.","scope":"endpoint"},{"status":429,"code":"rate_limited","description":"An anonymous, signed-request or API-key allowance was exceeded.","action":"Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.","scope":"common"},{"status":500,"code":"internal_error","description":"An unexpected server error occurred. Internal details are not returned.","action":"Retry reads with bounded backoff. Check write results before sending a new signed operation.","scope":"common"},{"status":503,"code":"busy","description":"The application has reached a temporary concurrency or database limit.","action":"Wait `Retry-After` seconds and retry with bounded backoff.","scope":"common"},{"status":503,"code":"temporarily_unavailable","description":"OAuth error: too many apps are registered without a card right now.","action":"Register the app from /developers, with a card.","scope":"endpoint"}],"responseHeaders":[{"name":"Content-Type","value":"application/json","description":"JSON, also for errors."},{"name":"Cache-Control","value":"no-store","description":"Private: never cached."}],"bodyFields":[{"name":"redirect_uris","in":"body","required":true,"description":"1 to 10: https, or http on the loopback interface."},{"name":"client_name","in":"body","required":true,"description":"1 to 60 characters; it may not say Veil."},{"name":"token_endpoint_auth_method","in":"body","required":false,"description":"client_secret_basic (default), private_key_jwt or none."},{"name":"grant_types, response_types","in":"body","required":false,"description":"authorization_code (and refresh_token); code."},{"name":"id_token_signed_response_alg","in":"body","required":false,"description":"EdDSA (default) or ES256."},{"name":"jwks","in":"body","required":false,"description":"With private_key_jwt: 1 to 8 public keys. jwks_uri and logo_uri are not read."}],"documentationUrl":"https://veil.rip/docs/oidc-register","supportsBrowserFetch":false,"browserMode":"local-or-server"}}