Notes

OAuth Dynamic Client Registration (DCR) is really cool. It solves the bottleneck of manually registering client applications with an authorization server (AS).

Traditionally, we had a limited, fixed set of client apps that needed to be registered with the AS ahead of time, usually by a human filling out a form on some admin dashboard. But with the explosion of MCP servers and AI agents that need to connect to dozens, sometimes hundreds of different services on the fly, that manual, human-in-the-loop registration model breaks down completely. You can’t have a developer registering a client every time an agent wants to talk to a new remote server.

DCR solves this by letting the client itself call the AS’s registration endpoint with a JSON payload describing itself (redirect URIs, grant types, token endpoint auth method, etc.). The registration endpoint’s location is typically discovered via the AS’s metadata document, which lives at a well-known URL. The AS validates the request and returns a client_id (and optionally a client_secret) right then and there, without any human intervention required to pre-register the client.

This is exactly what lets an MCP client discover a new remote server, register itself as an OAuth client on the spot, and complete the authorization flow, all without any prior coordination.