Create OAuth client
Register a new OAuth application; the server generates client_id. v1 clients are public/PKCE (no secret). A confidential client (fast-follow) returns client_secret in the create envelope ONCE. Tell the user to store it; it is unrecoverable and must never be logged. permissions is the ceiling the client may request; redirect_uris is an exact-match https allow-list (closes open-redirect). Dedup (team_sid, name) → already_exists. Set platform:true (admin only) to register a platform client with no owning team.
Contract:
- MCP tool
create_oauth_client, registry packagemcp.id/oauth_clients, mountid.access. - Operation
create, response envelopecreate. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.
Authorizations
Access token issued by gtm.service.id. Its access_identity claim carries team_sid, actor_sid and actor_type, and that team scope is authoritative.
Team scope for tokens that do not carry one. Ignored when the token already names a team.
Body
Request body of create_oauth_client.
1 - 255Exact-match https allow-list (at least one entry).
12048^https:\/\/Unified permission ceiling the client may request.
128Default: [authorization_code, refresh_token].
1authorization_code, refresh_token Admin only: register a platform client (team_sid = null) instead of a team client.