Dynamic Client Registration (RFC 7591)

POST

/auth/v4/register

Registers a Solution Provider client and returns its client_id (RFC 7591). Lets Solution Providers onboard without manual registration.

Public clients set token_endpoint_auth_method: none (no secret; PKCE required). Confidential clients receive a client_secret. redirect_uris are validated and later enforced by exact match at /auth/v4/authorize.

Proxied to Walmart IAM’s registration endpoint (ADR-026/ADR-048). RFC 7592 registration management (read/update/delete via a registration_access_token) is not offered in this version.

Registers a Solution Provider client and returns its `client_id` (RFC 7591). Lets Solution Providers onboard without manual registration. Public clients set `token_endpoint_auth_method: none` (no secret; PKCE required). Confidential clients receive a `client_secret`. `redirect_uris` are validated and later enforced by exact match at `/auth/v4/authorize`. Proxied to Walmart IAM's registration endpoint (ADR-026/ADR-048). RFC 7592 registration management (read/update/delete via a `registration_access_token`) is not offered in this version.

Request

This endpoint expects an object.

redirect_urislist of stringsRequired

Registered callback URIs. Enforced by exact match at authorize. HTTPS (or localhost).

token_endpoint_auth_methodenumOptionalDefaults to none

none for public clients (PKCE), client_secret_post/client_secret_basic for confidential.

grant_typeslist of enumsOptional

Grants the client will use.

response_typeslist of enumsOptional

Must be [code].

client_namestringOptional

Human-readable name shown on the consent screen.

scopestringOptional

Space-delimited scopes the client may request (subset of the sellerAuth catalog + offline_access).

client_uristringOptionalformat: "uri"

Homepage of the client.

logo_uristringOptionalformat: "uri"

Logo shown on the consent screen.

contactslist of stringsOptional

Contact emails for the client.

Response

Client registered.

client_idstring

Issued client identifier.

redirect_urislist of strings

Registered callback URIs.

token_endpoint_auth_methodstring

The registered client authentication method.

client_id_issued_atlongOptional

Issue time (Unix epoch seconds).

client_secretstringOptional

Issued only for confidential clients. Treat as a secret; never log.

client_secret_expires_atlongOptional

Secret expiry (Unix epoch seconds); 0 = never. Absent for public clients.

grant_typeslist of stringsOptional

Registered grant types.

client_namestringOptional

Registered client name.

scopestringOptional

Registered scopes.

Errors

400

Bad Request Error

401

Unauthorized Error

429

Too Many Requests Error

500

Internal Server Error