> For the complete documentation index, see [llms.txt](https://docs.tiny.plus/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tiny.plus/api/getting-access/register-a-client-app.md).

# Register a Client App

{% hint style="info" %}
You only need a Client App if you're building an integration for other tiny+ customers, not just your organisation.
{% endhint %}

Are you building an integration with tiny+, and need a way to allow your customers to access their tiny+ data in your app? You'll need to register a Client App.

## Register your app

Your app can register itself by sending its details to our registration endpoint. This is OAuth dynamic client registration ([RFC 7591](https://www.rfc-editor.org/rfc/rfc7591)).

<mark style="color:green;">`POST`</mark> `https://api.tiny.plus/oauth/register`

#### Request Body

Send a JSON object with `Content-Type: application/json`:

| Name            | Type   | Description                                                                                                                                                                                                                                                                                                                                                                                                    |
| --------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| redirect\_uris  | array  | <p><strong>Required.</strong> One to five addresses to send people back to after they approve your app. Each must be one of these, with no <code>#</code> fragment:</p><ul><li>an <code>https</code> address;</li><li><code>http</code> on <code>localhost</code>, <code>127.0.0.1</code> or <code>\[::1]</code>;</li><li>a private scheme for a native app, such as <code>myapp\://callback</code>.</li></ul> |
| client\_name    | string | Your app's name, shown to people when they approve it.                                                                                                                                                                                                                                                                                                                                                         |
| client\_uri     | string | Your app's homepage, as an `https` address.                                                                                                                                                                                                                                                                                                                                                                    |
| scope           | string | The scopes your app will ask for, separated by spaces: `read`, `readwrite`, or both.                                                                                                                                                                                                                                                                                                                           |
| grant\_types    | array  | Optional. Only `authorization_code` and `refresh_token` are allowed.                                                                                                                                                                                                                                                                                                                                           |
| response\_types | array  | Optional. Only `code` is allowed.                                                                                                                                                                                                                                                                                                                                                                              |

```javascript
{
    "client_name": "Example App",
    "client_uri": "https://app.example.com",
    "redirect_uris": ["https://app.example.com/tiny/callback"],
    "scope": "read readwrite"
}
```

{% tabs %}
{% tab title="201 Your app is registered." %}

```javascript
{
    "client_id": "dcr_1a2b3c4d5e6f7a8b9c0d1e2f",
    "client_id_issued_at": 1790000000,
    "client_name": "Example App",
    "redirect_uris": ["https://app.example.com/tiny/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "token_endpoint_auth_method": "none",
    "client_uri": "https://app.example.com",
    "scope": "read readwrite"
}
```

{% endtab %}

{% tab title="400 Something in the request isn't allowed." %}

```javascript
{
    "error": "invalid_redirect_uri",
    "error_description": "redirect_uris must be a non-empty list."
}
```

{% endtab %}

{% tab title="429 Too many registrations." %}

```javascript
{
    "error": "too_many_requests",
    "error_description": "Too many registrations from this address; try again in an hour."
}
```

{% endtab %}
{% endtabs %}

Keep the `client_id`. Your app uses it in the [OAuth authorisation process](/api/getting-access/oauth-authorisation-process.md).

* A registered app is a public client. It gets a client ID but no secret, and must use PKCE when it sends people to sign in.
* When someone is asked to approve your app, the page tells them that the app registered itself.
* An app that nobody approves within 24 hours of registering is removed. If that happens, register again.
* Registration is limited to 20 an hour from the same address.

## Other kinds of app

If your app needs a client secret, or anything else registration doesn't offer, email <support@tiny.plus>. Include a name for your app, a short paragraph describing your intended usage, and your callback URL. We will get back to you ASAP.