Dynamic Client Registration

AIGW exposes Dynamic Client Registration at:

POST https://api.aigw.loginid.ai/api/register

Example request

{
  "client_name": "My agent",
  "redirect_uris": ["https://agent.example.com/callback"],
  "token_endpoint_auth_method": "client_secret_post"
}

Registration requirements

• Redirect URIs must be absolute HTTPS and share a host within one registration.
• Agent-domain verification requirements depend on the authorization server’s policy. A registration response with verification_method: none does not establish control of the agent’s domain or grant access to a Resource.
• Omit Resource scopes during DCR. AIGW accepts openid, profile, email, phone, ext_token:read, and offline_access at registration. Omitting scope registers this set; request merchant scopes during Resource authorization.
• Resource scopes are requested later at authorization time.

Response

HTTP 201 Created:

{
  "client_id": "<AGENT_CLIENT_ID>",
  "client_secret": "<AGENT_CLIENT_SECRET>",
  "client_secret_expires_at": 0,
  "client_name": "My agent",
  "redirect_uris": ["https://agent.example.com/callback"],
  "client_id_issued_at": 1792584000,
  "token_endpoint_auth_method": "client_secret_post",
  "scope": "openid profile email phone ext_token:read offline_access",
  "domain": "agent.example.com",
  "verification_method": "none",
  "issuer": "https://core.api.aigw.loginid.ai/",
  "openid_configuration": "https://core.api.aigw.loginid.ai/.well-known/openid-configuration",
  "authorization_endpoint": "https://core.api.aigw.loginid.ai/oauth2/auth",
  "token_endpoint": "https://core.api.aigw.loginid.ai/oauth2/token",
  "jwks_uri": "https://core.api.aigw.loginid.ai/.well-known/jwks.json"
}

Field	Meaning
client_id	Client identifier to persist and reuse
client_secret	Returned for secret-based clients only; store it securely at registration
client_secret_expires_at	Secret expiry as Unix seconds; 0 means no scheduled expiry. Absent when no secret is issued
client_name, redirect_uris	Registered name and allowed callbacks
client_id_issued_at	Registration time as Unix seconds
token_endpoint_auth_method	Authentication method to use for this client
scope	Space-separated registered scopes; request merchant scopes during Resource authorization
domain, verification_method	Redirect domain and verification result: platform, wba, rdns, kya, or none
issuer, openid_configuration, authorization_endpoint, token_endpoint, jwks_uri	Core issuer, discovery URL, and OAuth endpoints
kya	Optional list of accepted KYA credentials when supplied at registration

For Resource access, use authorization_endpoint from that Resource's discovery metadata. Registration metadata can describe the core server and must not override the Resource-specific authorization endpoint.

Client authentication variants

client_secret_post is the default confidential registration shown above. client_secret_basic sends its secret through HTTP Basic; public none clients have no secret and require PKCE. AIGW also accepts private_key_jwt with an inline public jwks; a remote jwks_uri is explicitly refused for this registration path. Honor the returned method and keep private keys on the client.

Secrets are creation-time values. Reuse your registration instead of creating a client per request. POST /api/register/cimd is a separate registration path that returns an AIGW-hosted client metadata URL as the client ID; it is distinct from an agent-hosted HTTPS metadata document.

Errors

An invalid callback returns HTTP 400 Bad Request:

{
  "error": "invalid_redirect_uri",
  "error_description": "redirect_uris must be absolute https urls"
}

HTTP status	error	Action
400	invalid_redirect_uri	Use absolute HTTPS callbacks with the same host
400	invalid_client_metadata	Check the client name, authentication method, and public key fields
500	internal_error	Retry with backoff; contact support if the failure persists

Use error to select recovery behavior. error_description is optional diagnostic text and may vary.