Client registration #

To use the OAuth flow your application needs a client. There are two ways to get one.

From the dashboard (recommended) #

Sign in to microbooks.io and go to Developers → OAuth apps. Apps created here:

• are public PKCE clients — no secret to store or leak,
• are owned by your account, so you can rename them, change redirect URIs, or delete them later,
• appear on your users’ consent screens under the name you choose.

Dynamic client registration (RFC 7591) #

Clients can also be registered programmatically:

curl --request POST 'https://auth.microbooks.io/oauth/register' \
--header 'Content-Type: application/json' \
--data-raw '{
    "client_name": "Acme Books Sync",
    "redirect_uris": ["https://acme.example/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "token_endpoint_auth_method": "none"
}'

Response #

{
    "client_id": "9d2f6a7e-4c31-4f7b-9b1e-8b3f2a1c0d9e",
    "client_name": "Acme Books Sync",
    "redirect_uris": ["https://acme.example/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "token_endpoint_auth_method": "none"
}

Notes:

• Redirect URIs must be HTTPS, except on localhost/127.0.0.1 for development.
• Only public clients ("token_endpoint_auth_method": "none") can be created this way; PKCE is mandatory for them.
• If you send a valid bearer token with the registration request, the client is linked to your account and shows up under Developers → OAuth apps. Anonymous registration works too, but such clients cannot be managed later.

Managing clients over the API #

Owned clients can also be managed with the bearer-authenticated endpoints: