client

tcmts.registry.http.oauth.client · #zqg25mq6 · term · runs anywhere

The registry's OAuth client metadata document, served where its client id says (/api/oauth/client; tcm registry serves it): what an AT Protocol server reads to know the registry that's asking. A public client, with DPoP, coming back to the registry's home.

import { REGISTRY_SCOPE } from "#codebase/tcmts/registry/session";

export function client(request: Request): Record<string, unknown> {
  const home = new URL(request.url).href.replace(/\/api\/oauth\/client(?:\?.*)?$/, "/");
  return {
    client_id: `${home}api/oauth/client`,
    client_name: "tcm registry",
    client_uri: home,
    redirect_uris: [home],
    scope: REGISTRY_SCOPE,
    grant_types: ["authorization_code", "refresh_token"],
    response_types: ["code"],
    token_endpoint_auth_method: "none",
    application_type: "web",
    dpop_bound_access_tokens: true,
  };
}

uses

used by