`POST /oauth/register`

OAuth uses S256 PKCE, an exact redirect URI and a separate resource for REST or MCP. Consent is completed in Tong. Refresh tokens rotate on every use.

Request example#

curl -X POST 'https://platform.tongai.io/oauth/register' \  -H "Content-Type: application/json" \  -d '{  "client_name": "example",  "redirect_uris": [    "https://your-app.example/events"  ],  "scope": "example"}'

Configuration

curl --version

Authentication#

none

Parameters#

No parameters are required.

Request body#

application/json

client_namestringRequired

Minimum length: 1 characters.

Maximum length: 120 characters.

redirect_urisstring[]Required

Minimum items: 1.

Maximum items: 10.

scopestringRequired

Maximum length: 3000 characters.

token_endpoint_auth_methodstringOptional

Allowed values"none"

Default: "none".

grant_typesstring[]Optional

Default: ["authorization_code","refresh_token"].

response_typesstring[]Optional

Default: ["code"].

Response schema#

Response

JSON

{  "client_id": "e8aa0a87-6cd9-42eb-975a-b72bf43218c8",  "client_name": "Your application",  "redirect_uris": [    "https://your-app.example/oauth/callback"  ],  "scope": "catalog:read operations:read",  "token_endpoint_auth_method": "none",  "grant_types": [    "authorization_code",    "refresh_token"  ],  "response_types": [    "code"  ]}

Errors and limits#

Response

JSON

{  "error": "invalid_client_metadata"}

AuthenticationAPI keys charge the account that owns the key. OAuth lets each connected user use their own credits.Errors and rate limitsUnderstand error responses, retry safely and recover from failed generations.Requests and logsAn accepted request is not a finished generation. Track the saved job until its output is ready.