Dynamic Client Registration API¶

Templatized Dynamic Client Registration¶

Creating templatized clients only require a single parameter to indicate which client template to instantiate.

Parameter	Type	Description
`software_id`	String	The ID of the client template to instantiate

Non-Templatized Dynamic Client Registration¶

When creating a regular DCR client the request is a combination of grant_types and additional settings depending on what grant_types are requested.

Parameter	Type	Description
`access_token_ttl`	Integer	The TTL of the Access Token in seconds.
`allow_per_request_redirect_uris`	Boolean	(Deprecated). When using PAR, should each request be allowed to vary the redirect_uri. This is be replaced by redirect policies which are configured on the profile.
`allowed_origins`	String Array	A list of urls allowed to frame the flows.
`application_url`	URI	A url of the application that the user may be redirected to if the session expires or the user bookmarks the login. Must reside on the same domain as a redirect URI.
`authenticator_filters`	String Array	A list of authenticator filter id’s
`authorization_signed_response_alg`	String	The algorithm to use for Jwt Secured Authorization Response Mode (JARM).
`backchannel_authentication_request_signing_alg`	String	The algorithm to use for signed requests when using CIBA.
`backchannel_client_notification_endpoint`	`-`	Not used as only Poll deliver mode is supported.
`backchannel_logout_uri`	URI	A URI to call during OIDC back-channel logout.
`backchannel_token_delivery_mode`	String	The only available mode is `poll`.
`backchannel_user_code_parameter`	Boolean	If back channel user code should be used with CIBA.
`client_name`	String	A human readable name of the client.
`client_secret_expires_at`	`-`	Not supported.
`client_uri`	URI	A URI to a webpage showing information about the client. Must reside on the same domain as a redirect URI.
`default_max_age`	Integer	A default `max_age` used for user authentication.
`default_acr_values`	String Array	The authenticator ACRs to be used for this client.
`disallowed_proof_key_challenge_methods`	String Array	A list of PKCE challenge methods that should be disabled.
`frontchannel_logout_uri`	URI	A URI to call during front-channel logout. Must reside on the same domain as a redirect URI.
`grant_types`	String Array	A list of grant_types and capabilities for this client. Possible values are: `authorization_code`, `client_credentials`, `https://curity.se/grant/assisted-token`, `implicit`, `urn:ietf:params:oauth:grant-type:device_code`, `urn:openid:params:grant-type:ciba`, `password`.
`id_token_encrypted_response_alg`	String	The key encryption algorithm to use for encrypted ID token responses.
`id_token_encrypted_response_enc`	String	The content encryption algorithm to use for encrypted ID token responses.
`id_token_signed_response_alg`	String	The ID token signing algorithm to be used.
`id_token_ttl`	Integer	The number of seconds the ID token should be valid for.
`initiate_login_uri`	URI	RP Initiated Login URI. Must reside on the same domain as a redirect URI.
`jwks`	JSON	A Json Web Key Set containing the public keys this client will use. Combine with `token_endpoint_auth_method` to enable Client Assertions for client authentication.
`jwks_uri`	URI	A URI pointing to a JWKS resource where the public keys for the client are published. Combine with `token_endpoint_auth_method` to enable Client Assertions for client authentication.
`logo_uri`	URI	A URI to a logo for the client. Must reside on the same domain as a redirect URI.
`policy_uri`	URI	A URI to a logo for the client. Must reside on the same domain as a redirect URI.
`post_logout_redirect_uris`	URI Array	A set of URIs allowed to redirect the user to after logout.
`redirect_uris`	URI Array	A set of URIs allowed to redirect to for front-channel flows.
`refresh_token_max_rolling_lifetime`	Integer	The max number of seconds the refresh tokens may be refreshed from the time of original issuance.
`refresh_token_ttl`	Integer	Time in seconds that the refresh token is valid. `0` will disable the use of refresh tokens.
`request_object_signing_alg`	String	The whitelisted request object signing algorithm to be used with this client.
`request_uris`	URI Array	A list of request_uri’s allowed for Request Object by reference.
`require_proof_key`	Boolean	Requires PKCE to always be used if set to true.
`require_pushed_authorization_requests`	Boolean	Requires PAR to always be used if set to true.
`requires_consent`	Boolean	Enables User Consent for this client.
`scope`	String	Space separated string of scopes.
`sector_identifier_uri`	URI	Sector identifier URI for when using PPID.
`subject_type`	String	`public` or `pairwise`. Pairwise enables PPID.
`tls_client_auth_subject_dn`	String	The client certificate DN.
`token_endpoint_auth_method`	String	The authentication method to use on the token endpoint for client authentication.
`token_endpoint_auth_signing_alg`	String	The signing algorithm to use on the token endpoint for client authentication.
`tos_uri`	URI	A URI for the Terms of Service for the client. Must reside on the same domain as a redirect URI.
`userinfo_signed_response_alg`	String	The signing algorithm to use for signed userinfo responses. This effectively toggles on signed responses for userinfo.

Custom Client Properties¶

It is possible to send custom properties that should be stored as client properties. Any non standard parameter will be recognized as a custom client property and stored as such. These are later available when issuing tokens etc.