DCR
Open API ecosystems where any agent can self-register. No pre-existing trust relationship needed.
DCR (Dynamic Client Registration, RFC 7591) is the auth.md flow where the agent registers as an OAuth 2.0 client by POSTing metadata to the registration endpoint. The service responds with client_id and client_secret for use with the client_credentials grant.
How It Works
Dynamic Client Registration (RFC 7591) lets agents register programmatically without pre-existing trust. The agent POSTs its metadata and receives OAuth credentials.
After registration the agent uses the standard client_credentials grant: POST to the token endpoint with client_id and client_secret to get an access token, then use it as a Bearer token.
The auth.md file should include the token_endpoint so agents can complete the full flow without additional discovery.
Steps
- 1
Agent fetches /auth.md and reads DCR flow declaration
- 2
Agent POSTs client metadata to register_uri (per RFC 7591)
- 3
Service responds with client_id, client_secret, and token_endpoint
- 4
Agent POSTs to token_endpoint with grant_type=client_credentials
- 5
Service issues access token
- 6
Agent uses access token as Bearer token
When to use
Open API ecosystems where any agent can self-register. No pre-existing trust relationship needed.
Example
// Step 1: Register
POST /agent/register HTTP/1.1
Content-Type: application/json
{"client_name":"my-agent","grant_types":["client_credentials"],"scope":"read:data"}
// Response
{"client_id":"agent_abc","client_secret":"secret_xyz","token_endpoint":"https://api.example.com/oauth/token"}
// Step 2: Get token
POST /oauth/token
grant_type=client_credentials&client_id=agent_abc&client_secret=secret_xyz