Defines how the client_id is determined. It can either be generated or taken from a request parameter.

Client ID From Request UUID Client ID

Generator for the client_secret. The client secret is only generated, if this property is configured and the determined token_endpoint_auth_method is either "client_secret_basic" or "client_secret_post".
In addition, a "Token Endpoint Auth Method Processor" is required to determine the authentication method.

Dynamic Active Directory String Generator Pattern-based Random String Generator

Processors that handle the attributes of the registration request (other than the requested grants). Only attributes for which a processor is configured here are handled; all other aspects of the registration request are ignored.

Client Name Processor Contacts Processor Scope Processor Software ID and Software Version Processor Token Endpoint Auth Method Processor URIs Processor

If enabled, the technical client ID is included in the registration response.

The technical client ID is not identical to the client ID that is also sent with the response. The technical client ID can be used to further administer the newly created client, e.g. via Adminapp REST API.

false

If enabled, Authorization Code Grant is supported.

The registered client will be enabled to perform the authorization code grant in any of the following cases:

• If the "grant_types" requested by the client include "authorization_code". In this case a "redirect_uri" must be present.
• If the requested "response_types" include "code". In this case a "redirect_uri" must be present.
• If the client requests no "grant_types" and no "response_types", but supplies a "redirect_uri".

The "grant_types" of the registered client will include "authorization_code" and the "response_types" will include "code".

If this property is disabled, authorization code grant is never enabled for the client.

Note: this is not enforced at runtime. Whether the resulting client can actually use this grant is governed solely by the Authorization Server's own grant configuration, which applies identically to every client regardless of DCR registration.

true

If enabled, Implicit Grant is supported.

The registered client will be enabled to perform implicit grant in any of the following cases:

• If the "grant_types" requested by the client include "implicit". In this case, a "redirect_uri" must be present.
• If the requested "response_types" include "token". In this case, a "redirect_uri" must also be present.
• If the client requests no "grant_types" and no "response_types", but supplies a "redirect_uri".

The "grant_types" of the registered client will include "implicit" and the "response_types" will include "token".

If this property is disabled, implicit grant is never enabled for the client.

Note: this is not enforced at runtime. Whether the resulting client can actually use this grant is governed solely by the Authorization Server's own grant configuration, which applies identically to every client regardless of DCR registration.

false

If enabled, Client Credentials Grant is supported.

The registered client will be enabled to perform client credentials grant in any of the following cases:

• If the "grant_types" requested by the client include "client_credentials".
• If the client specifies no "grant_types" in the registration request.

If this property is disabled, client credentials grant is never enabled for the client.

Note: this is not enforced at runtime. Whether the resulting client can actually use this grant is governed solely by the Authorization Server's own grant configuration, which applies identically to every client regardless of DCR registration.

false

If enabled, refreshing an access token is supported.

The registered client will be enabled to refresh access tokens in any of the following cases:

• If the "grant_types" requested by the client include "refresh_token".
• If the client specifies no "grant_types" in the registration request.

If this property is disabled, refreshing of access tokens is never enabled for the client.

Note: this is not enforced at runtime. Whether the resulting client can actually use this grant is governed solely by the Authorization Server's own grant configuration, which applies identically to every client regardless of DCR registration.

true