Register Client

curl -X POST 'https://api.resend.com/oauth/register' \
     -H 'Content-Type: application/json' \
     -d $'{
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none",
  "scope": "emails:send"
}'

curl -X POST 'https://api.resend.com/oauth/register' \
     -H 'Content-Type: application/json' \
     -d $'{
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "client_secret_basic",
  "scope": "emails:send"
}'

{
  "client_id": "550e8400-e29b-41d4-a716-446655440000",
  "client_id_issued_at": 1750000000,
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none",
  "scope": "emails:send"
}

{
  "client_id": "550e8400-e29b-41d4-a716-446655440000",
  "client_id_issued_at": 1750000000,
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "client_secret_basic",
  "scope": "emails:send",
  "client_secret": "3vProAFw7...store-this-now...KpQ",
  "client_secret_expires_at": 0
}

POST

oauth

curl -X POST 'https://api.resend.com/oauth/register' \
     -H 'Content-Type: application/json' \
     -d $'{
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none",
  "scope": "emails:send"
}'

curl -X POST 'https://api.resend.com/oauth/register' \
     -H 'Content-Type: application/json' \
     -d $'{
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "client_secret_basic",
  "scope": "emails:send"
}'

{
  "client_id": "550e8400-e29b-41d4-a716-446655440000",
  "client_id_issued_at": 1750000000,
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none",
  "scope": "emails:send"
}

{
  "client_id": "550e8400-e29b-41d4-a716-446655440000",
  "client_id_issued_at": 1750000000,
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "client_secret_basic",
  "scope": "emails:send",
  "client_secret": "3vProAFw7...store-this-now...KpQ",
  "client_secret_expires_at": 0
}

Dynamic Client Registration (DCR) lets a client obtain a client_id at runtime instead of being pre-registered by Resend. This endpoint is unauthenticated (no API key). By default it issues a public client that authenticates at the token endpoint with PKCE alone. Register with a client_secret_* authentication method to get a confidential client, which is issued a client_secret in the response. Confidential clients still complete PKCE on every authorization code exchange. The secret is an additional factor, not a replacement.

This endpoint is rate-limited to 20 registrations per hour per IP address. Requests over the limit get a 429 with {"error": "too_many_requests"}.

Body Parameters

string

required

A human-readable name for the client. Maximum 200 characters.

string[]

required

URIs the authorization server may redirect to after the user approves the request. At least one is required, up to 10, each up to 2048 characters. See Allowed redirect URIs for the rules.

string[]

default:"[\"authorization_code\", \"refresh_token\"]"

Must include authorization_code. refresh_token is also supported.

string[]

default:"[\"code\"]"

Only code is supported. The value is validated if present but not stored; the response always echoes back ["code"].

string

Space-delimited list of scopes to request, e.g. "emails:send". Must be a subset of the supported scopes. If omitted, the client is registered with every supported scope.

string

default:"none"

How the client authenticates at the token and revocation endpoints. none (the default) is a public client that proves itself with PKCE alone. client_secret_basic and client_secret_post are confidential clients that also present a client_secret, sent in the HTTP Authorization: Basic header or as a body parameter respectively. A client_secret_* method issues a client_secret in the response. See Confidential clients.

string

A URL for the client’s homepage. Echoed back, not otherwise used.

string

A URL for the client’s logo. Shown on the consent screen.

Confidential clients

Registering with token_endpoint_auth_method set to client_secret_basic or client_secret_post returns two extra fields:

string

The generated client secret. Returned only once, in this response. Resend stores a hash and can’t show it again, so persist it securely at registration time. If it’s lost, register a new client.

number

Unix time at which the secret expires. Always 0, meaning the secret does not expire.

Only register a confidential client when it has a backend that can keep the secret private, such as a server-side web app. Native, CLI, and other clients that can’t protect a secret should stay public (none) and rely on PKCE. See Building an OAuth client for how each client type authenticates.

Allowed redirect URIs

https:// URIs are unrestricted.
http:// is only allowed for loopback addresses (127.0.0.1, localhost, [::1]), for native/CLI clients that run a local callback server.
Private-use URI schemes (e.g. cursor://, vscode://) are allowed, since the OS routes them only to the registered native app.
file, ftp, data, javascript, blob, about, and vbscript schemes are rejected, and none of the URIs may include a fragment.

curl -X POST 'https://api.resend.com/oauth/register' \
     -H 'Content-Type: application/json' \
     -d $'{
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none",
  "scope": "emails:send"
}'

curl -X POST 'https://api.resend.com/oauth/register' \
     -H 'Content-Type: application/json' \
     -d $'{
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "client_secret_basic",
  "scope": "emails:send"
}'

{
  "client_id": "550e8400-e29b-41d4-a716-446655440000",
  "client_id_issued_at": 1750000000,
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none",
  "scope": "emails:send"
}

{
  "client_id": "550e8400-e29b-41d4-a716-446655440000",
  "client_id_issued_at": 1750000000,
  "client_name": "Example OAuth Client",
  "redirect_uris": ["http://127.0.0.1/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "client_secret_basic",
  "scope": "emails:send",
  "client_secret": "3vProAFw7...store-this-now...KpQ",
  "client_secret_expires_at": 0
}

Errors

Errors use the standard OAuth shape ({"error": "...", "error_description": "..."}) rather than Resend’s usual error format.

Status	`error`	When
`400`	`invalid_request`	A required field is missing, malformed, or a redirect URI is disallowed.
`400`	`invalid_scope`	`scope` includes a value outside the supported scope set.
`429`	`too_many_requests`	More than 20 registrations from this IP in the last hour.

Delete Webhook

Authorize

⌘I

API Reference

Sending

Receiving

Broadcasts

Automations

Events

Templates

Contacts

Contact Properties

Contact Imports

Segments

Topics

Audiences

Domains

Logs

API Keys

Suppressions

Authorized Apps

Webhooks

OAuth

Register Client

Body Parameters

Confidential clients

Allowed redirect URIs

Errors

​Body Parameters

​Confidential clients

​Allowed redirect URIs

​Errors

Body Parameters

Confidential clients

Allowed redirect URIs

Errors