Dynamic Client Registration (DCR)

OAuth 2.0 Dynamic Client Registration (DCR, RFC 7591, Proposed Standard, July 2015) defines a registration endpoint where a client posts its metadata, such as redirect URIs, grant types, and a name, and receives a client_id (and optionally a secret) without a human creating it in an admin console.

DCR was designed for ecosystems where clients cannot be known in advance, and it underpins open banking registration, where the request carries a signed software statement from a trusted directory. Open registration without that statement is the weak spot: anyone can create clients, so the authorization server accumulates thousands of unverifiable entries and has no basis for showing users who they are really consenting to. That is why the Model Context Protocol demoted DCR to a fallback behind pre-registration and Client ID Metadata Documents. If you must allow open DCR, rate-limit it, expire unused clients, and never let a self-registered client skip consent.

See also: Client ID Metadata Document, authorization server, authorization server metadata, MCP authorization, OAuth consent phishing, OAuth 2.0