--- title: Auth0 Has the Right Endpoint and Still Makes You Ask... description: Auth0 supports Dynamic Client Registration (RFC 7591) via POST /oidc/register, which allows machines to mint credentials without human intervention. However,... canonical: https://daily.dev/posts/auth0-has-the-right-endpoint-and-still-makes-you-ask-permission-y9mqnlcsf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Auth0 Has the Right Endpoint and Still Makes You Ask Permission | daily.dev og:description: Auth0 supports Dynamic Client Registration (RFC 7591) via POST /oidc/register, which allows machines to mint credentials without human intervention. However,... og:url: https://daily.dev/posts/auth0-has-the-right-endpoint-and-still-makes-you-ask-permission-y9mqnlcsf og:image: https://api.daily.dev/og/posts/Y9mqnLCsf.png og:image:alt: Auth0 Has the Right Endpoint and Still Makes You Ask Permission og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Auth0 Has the Right Endpoint and Still Makes You Ask Permission **[API Evangelist](https://daily.dev/sources/apievangelist)** · 11 min read · 0 upvotes · 1 comments ## Summary Auth0 supports Dynamic Client Registration (RFC 7591) via POST /oidc/register, which allows machines to mint credentials without human intervention. However, this endpoint is disabled by default, gated behind Professional/Enterprise plans, and requires additional configuration. The practical alternative is the Management API (POST /api/v2/clients), which requires a pre-existing M2M client to bootstrap credentials. A Node.js script is provided that handles both paths: the Management API by default, with a --dcr flag for tenants with DCR enabled. The author argues that Auth0, as an identity company, should enable agent-friendly client registration by default rather than treating it as an enterprise upsell. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does Auth0 support RFC 7591 Dynamic Client Registration and is it enabled by default? Auth0 does support Dynamic Client Registration at POST /oidc/register on a tenant's domain, accepting a client_name and redirect_uris and returning a client_id, client_secret, and client_secret_expires_at with no token required. However it is disabled by default on every tenant, requires at minimum a Professional or Enterprise plan, and needs manual configuration including default permissions for third-party apps before dynamically registered clients can reach any APIs. _Teams weighing OAuth providers for agent-driven registration compare these tenant setup quirks on daily.dev._ ### How do I create an Auth0 client programmatically without Dynamic Client Registration enabled? Use the Management API by calling POST /api/v2/clients with a name and app_type, which returns a client_id and client_secret with a 201 status. This requires a Management API access token carrying the create:clients scope, obtained by setting up a machine-to-machine application and exchanging its credentials at POST /oauth/token with grant_type=client_credentials and audience set to the tenant's api/v2 endpoint. _Automating Auth0 client provisioning is easier when you can see how others handled the token bootstrap, something daily.dev surfaces._ ### What happens if I try to create an Auth0 Management API client with a name that already exists? The POST /api/v2/clients request returns a 409 conflict status when an application with that name already exists. A working script pattern handles this by falling back to a search query against GET /api/v2/clients filtered by name, retrieving the existing client_id and client_secret instead of failing outright. _Developers scripting idempotent client provisioning against Auth0 track edge cases like this via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@andychiare** · 1 upvotes > Dynamic Client Registration **is not** an agent-friendly method for client registration. Originally designed for automated client registration, it is an older standard that was not built with AI agents in mind. > > When MCP emerged, DCR was the only available mechanism for automated client registration, despite its inherent security concerns. > > The emerging standard for secure dynamic registration in MCP is the [Client ID Metadata Document](https://www.google.com/url?source=gmail&sa=E&q=https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/) (CIMD), which is recommended by... ## Similar posts on daily.dev - [Okta Has the Endpoint for Programmatic Onboarding, It Just Hides the Door](https://daily.dev/posts/okta-has-the-endpoint-for-programmatic-onboarding-it-just-hides-the-door-dbdhuelal) · API Evangelist · 1 upvotes · 0 comments - [WSO2 API Manager Already Speaks Programmatic Onboarding](https://daily.dev/posts/wso2-api-manager-already-speaks-programmatic-onboarding-bvvgqaduc) · API Evangelist · 1 upvotes · 0 comments - [Ping Identity and the Two Roads to a Programmatic Client](https://daily.dev/posts/ping-identity-and-the-two-roads-to-a-programmatic-client-s4mbagyj1) · API Evangelist · 0 upvotes · 0 comments - [Client ID Metadata Documents \(CIMD\): The Future of MCP Authentication](https://daily.dev/posts/client-id-metadata-documents-cimd-the-future-of-mcp-authentication-64uvnfhan) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#oauth](https://daily.dev/tags/oauth), [#auth0](https://daily.dev/tags/auth0) [View this post on daily.dev](https://daily.dev/posts/auth0-has-the-right-endpoint-and-still-makes-you-ask-permission-y9mqnlcsf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Auth0 Has the Right Endpoint and Still Makes You Ask Permission","url":"https://daily.dev/posts/auth0-has-the-right-endpoint-and-still-makes-you-ask-permission-y9mqnlcsf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/auth0-has-the-right-endpoint-and-still-makes-you-ask-permission-y9mqnlcsf"},"datePublished":"2026-07-26T12:41:28.207Z","dateModified":"2026-09-13T21:55:47.951Z","description":"Auth0 supports Dynamic Client Registration (RFC 7591) via POST /oidc/register, which allows machines to mint credentials without human intervention. However,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1aa96432be32bc8ef059e2b3ba65d7cf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1aa96432be32bc8ef059e2b3ba65d7cf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"API Evangelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"API Evangelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a36244ae67bc4f41a605f780267ecb5f","url":"https://daily.dev/sources/apievangelist"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/auth0-has-the-right-endpoint-and-still-makes-you-ask-permission-y9mqnlcsf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"authentication,oauth,auth0","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"API Evangelist","item":"https://daily.dev/sources/apievangelist"},{"@type":"ListItem","position":3,"name":"Auth0 Has the Right Endpoint and Still Makes You Ask Permission"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/auth0-has-the-right-endpoint-and-still-makes-you-ask-permission-y9mqnlcsf","comment":[{"@type":"Comment","text":"Dynamic Client Registration is not an agent-friendly method for client registration. Originally designed for automated client registration, it is an older standard that was not built with AI agents in mind.\nWhen MCP emerged, DCR was the only available mechanism for automated client registration, despite its inherent security concerns.\nThe emerging standard for secure dynamic registration in MCP is the Client ID Metadata Document (CIMD), which is recommended by the MCP specs as the primary registration method.\nTo learn more about the difference between DCM and CIMD, read this.\nCurrently, Auth0 supports manual CIMD registration but dynamic registration is in the pipeline.","datePublished":"2026-10-01T13:10:14.924Z","url":"https://daily.dev/posts/Y9mqnLCsf#c-MWOWMHz6J","author":{"@type":"Person","name":"Andrea Chiarelli","url":"https://daily.dev/andychiare","image":"https://avatars.githubusercontent.com/u/25705235?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/auth0-has-the-right-endpoint-and-still-makes-you-ask-permission-y9mqnlcsf#faq","mainEntity":[{"@type":"Question","name":"Does Auth0 support RFC 7591 Dynamic Client Registration and is it enabled by default?","acceptedAnswer":{"@type":"Answer","text":"Auth0 does support Dynamic Client Registration at POST /oidc/register on a tenant's domain, accepting a client_name and redirect_uris and returning a client_id, client_secret, and client_secret_expires_at with no token required. However it is disabled by default on every tenant, requires at minimum a Professional or Enterprise plan, and needs manual configuration including default permissions for third-party apps before dynamically registered clients can reach any APIs. Teams weighing OAuth providers for agent-driven registration compare these tenant setup quirks on daily.dev."}},{"@type":"Question","name":"How do I create an Auth0 client programmatically without Dynamic Client Registration enabled?","acceptedAnswer":{"@type":"Answer","text":"Use the Management API by calling POST /api/v2/clients with a name and app_type, which returns a client_id and client_secret with a 201 status. This requires a Management API access token carrying the create:clients scope, obtained by setting up a machine-to-machine application and exchanging its credentials at POST /oauth/token with grant_type=client_credentials and audience set to the tenant's api/v2 endpoint. Automating Auth0 client provisioning is easier when you can see how others handled the token bootstrap, something daily.dev surfaces."}},{"@type":"Question","name":"What happens if I try to create an Auth0 Management API client with a name that already exists?","acceptedAnswer":{"@type":"Answer","text":"The POST /api/v2/clients request returns a 409 conflict status when an application with that name already exists. A working script pattern handles this by falling back to a search query against GET /api/v2/clients filtered by name, retrieving the existing client_id and client_secret instead of failing outright. Developers scripting idempotent client provisioning against Auth0 track edge cases like this via daily.dev."}}]} ```