Dynamic Client Registration

Learn how to dynamically register third-party applications with Auth0.

You can dynamically register third-party applications for your tenant. Dynamic Client Registration (DCR) is based on the OpenID Connect Dynamic Client Registration specification.

All applications created through Dynamic Client Registration are third-party applications with enhanced security controls. This means DCR clients:

• Receive a tpc_ client ID prefix
• Require PKCE for authorization code flows
• Support only authorization_code and refresh_token grant types. The client_credentials grant type is not available via DCR.
• Can only access APIs through explicit client grants
• Can only use domain-level connections for authentication

Enable Dynamic Client Registration

Auth0 supports Open Dynamic Registration. If enabled, anyone will be able to create applications in your tenant without a token.

By default, Dynamic Client Registration is disabled for all tenants. To enable Dynamic Client Registration, use the Auth0 Dashboard or Management API.

Auth0 Dashboard

1. Navigate to Dashboard > Settings > Advanced and enable Dynamic Client Registration (DCR).

Management API

Set the enable_dynamic_client_registration flag to true in your tenant settings using the /api/v2/tenants/settings endpoint.

You need to update the {YOUR_MANAGEMENT_API_TOKEN} with a valid token with the scope update:tenant_settings. To learn more, read Management API Access Tokens.

Configure API access for DCR clients

Before enabling DCR, configure default permissions for third-party applications on the APIs that dynamically registered clients should access. Without default permissions, DCR clients will not be able to access any API.

Default permissions define a baseline set of APIs and scopes available to all third-party applications automatically. This is essential for DCR because you cannot configure per-application client grants during the registration flow.

To learn how to configure default permissions, read Configure Third-Party Applications.

Register an application

To dynamically register an application, make a POST request to the /oidc/register endpoint. Because Auth0 supports Open Dynamic Registration, the /oidc/register endpoint accepts registration requests without an access token.

Parameter	Description
client_name	The name of the application to create.
redirect_uris (required)	An array of URLs that Auth0 will accept as valid callback URLs at the end of an authentication flow.
token_endpoint_auth_method	The authentication method for the token endpoint. Use none for public clients (SPA, Native) or client_secret_post (default) for confidential clients.
grant_types	The grant types the application wants to use. Filtered down in response to reflect the ones it will be allowed to use. Applications created through DCR support authorization_code and refresh_token.
response_types	The response types the application will use. Use code for authorization code flow.

If successful, Auth0 returns the application credentials:

{
  "client_name": "My Dynamic Application",
  "client_id": "tpc_8SXWY6j3afl2CP5ntwEOpMdPxxy49Gt2",
  "client_secret": "Q5O...33P",
  "redirect_uris": [
    "https://application.example.com/callback"
  ],
  "client_secret_expires_at": 0,
  "grant_types": ["authorization_code", "refresh_token"],
  "token_endpoint_auth_method": "none"
}

Field	Description
client_id	Unique application identifier with a tpc_ prefix. Use this when initiating authentication flows.
client_secret	Application secret for confidential clients. Not returned when token_endpoint_auth_method is none.
client_secret_expires_at	Expiration time for the client secret. Always 0 (never expires) for Auth0.

Third-party developers cannot modify application settings after registration. If changes are necessary, they must contact the tenant owner.

After registration, the application can initiate an Authorization Code Flow with PKCE using the client_id and configured redirect_uris.

Tenant Access Control List (ACL)

Auth0 provides a Tenant Access Control List (ACL) to manage traffic to the /oidc/register endpoint. You can restrict who can send DCR requests by configuring ACL rules based on:

• Source IP addresses and CIDR ranges
• Geolocation
• Other request signals

To configure ACL rules for DCR, add the dcr scope to an ACL rule. To learn more, read Tenant ACL Reference.

Rate limits

The /oidc/register endpoint is rate-limited to 5 requests per second per tenant. To learn more about rate limits, read Rate Limit Configuration.

Permissive mode for DCR

Some customers who were using third-party applications before April 2026 can configure DCR to create applications with pre-existing behavior instead of enhanced security controls. To learn more, read Dynamic Client Registration in Permissive Mode.

Learn more

• Third-Party Applications
• Security Controls for Third-Party Applications
• Application Access to APIs: Client Grants
• First-Party and Third-Party Applications
• User Consent and Third-Party Applications