API Reference
OAuth

Dynamic client registration

POST
/oauth/register

RFC 7591. Unauthenticated, and it WRITES on every hit — a client mints a new registration by calling it — so it is rate-limited per IP (20/minute). That bounds the rate of growth, not the total: stale client rows are not yet swept.

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/oauth/register"
{}
{  "error": {    "code": "validation.bad_request",    "message": "string",    "request_id": "string",    "details": [      "string"    ]  }}
{  "error": {    "code": "validation.bad_request",    "message": "string",    "request_id": "string",    "details": [      "string"    ]  }}

OAuth 2.1 authorization server metadata GET

RFC 8414 discovery document. Unauthenticated.

Authorization endpoint GET

RFC 6749 §4.1 with PKCE. Redirects the browser to the Sautikit consent screen, which drives `GET /v1/oauth/authorization/{req}` and `POST /v1/oauth/authorization/{req}/decision` behind the session cookie. Deliberately not rate-limited: legitimate clients re-authorize.