Dynamic Client Registration

Build RFC 7591 DCR registration payloads, software_statement JWTs, curl/fetch snippets, and inspect registration responses — 100% client-side.

Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Build RFC 7591 Dynamic Client Registration requests, optional software_statement JWTs, and POST live to your AS /register via browser-direct or the stbox HTTP proxy (same BYOP path as OAuth).

🔒 100% Client-Side Cryptography (Web Crypto API)

Configuration

Registration endpoint

Initial access token (optional)

client_name

client_uri

logo_uri

scope

redirect_uris (one per line)

grant_types

response_types

codetokenid_token

token_endpoint_auth_method

jwks_uri

contacts

software_id

software_version

Software statement (RFC 7591 §2.3)

iss

alg

Signing key (HMAC secret or PEM/JWK)

Execution mode

Registration JSON body

{
  "client_name": "stbox DCR demo",
  "client_uri": "https://client.example.com",
  "redirect_uris": [
    "https://client.example.com/callback",
    "https://client.example.com/oauth/callback"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": [
    "code"
  ],
  "token_endpoint_auth_method": "client_secret_basic",
  "scope": "openid profile offline_access",
  "contacts": [
    "admin@client.example.com"
  ]
}

What is Dynamic Client Registration?

RFC 7591 lets OAuth clients POST metadata (redirect URIs, grant types, auth method, JWKS) to an authorization server’s registration endpoint and receive a client_id (and optional client_secret) without manual admin provisioning.

This workbench helps you craft compliant payloads, optional software_statement JWTs, and copy-ready HTTP snippets. Responses are inspected locally — nothing is sent to stbox servers.

How to use this tool

Fill client metadata and grant/response types, then copy the JSON body or curl/fetch snippet for your AS /register endpoint.
Optionally sign a software_statement JWT (HS256/RS256/ES256) and attach it to the payload.
Paste a registration response to extract client_id, secret, and expiry timestamps.

Frequently asked questions

Does stbox call my authorization server?

Yes, only when you click Submit — via browser-direct fetch or the same stbox HTTP proxy (BYOP) used by OAuth/REST. Credentials are not stored on stbox after the request.

What is a software_statement?

An optional JWT (RFC 7591 §2.3) asserting software identity and metadata, typically signed by a software publisher and verified by the AS during registration.