# `ConduitMcp.Client.OAuth.Registration`
[🔗](https://github.com/nyo16/conduit_mcp/blob/v0.11.0/lib/conduit_mcp/client/oauth/registration.ex#L2)

Chooses the client identity presented to an authorization server, in
the MCP authorization spec's order (compiled only with `:finch`):

  1. **Pre-registered** - `pre_registered[issuer]` from the OAuth
     options. When pre-registered clients are configured but none is
     for this issuer, the server has moved to another authorization
     server and the flow stops with `:authorization_server_changed`
     (OA-6): credentials are bound to their issuer, and falling back to
     another method would silently re-identify the client.
  2. **Client ID Metadata Document** - when the authorization server
     advertises `client_id_metadata_document_supported: true` and
     `:client_metadata_url` is set, that URL is the client id (see
     `ConduitMcp.Client.OAuth.CIMD`).
  3. **Dynamic client registration** (RFC 7591; deprecated in MCP
     2026-07-28, kept for older authorization servers) - when the
     metadata has a `registration_endpoint`. The request declares
     `application_type` (`native` for a loopback or custom-scheme
     redirect URI, else `web`, unless `client_metadata` says
     otherwise), `grant_types: ["authorization_code", "refresh_token"]`,
     `response_types: ["code"]` and `token_endpoint_auth_method:
     "none"`. The registered client is kept in the token store under
     the issuer (`c:ConduitMcp.Client.OAuth.TokenStore.put_client/3`)
     and reused while its `redirect_uris` include the redirect URI, so
     a client registered with one authorization server is never shown
     to another.
  4. Otherwise `:no_registration_method`.

# `t`

```elixir
@type t() :: %{
  :client_id => String.t(),
  :auth_method => atom(),
  :method => :pre_registered | :cimd | :dcr,
  optional(atom()) => term()
}
```

A resolved client identity and how it was obtained.

# `resolve`

```elixir
@spec resolve(ConduitMcp.Client.OAuth.Config.t(), String.t(), map(), keyword()) ::
  {:ok, t()} | {:error, ConduitMcp.Client.OAuth.Error.t()}
```

Resolves the client identity for authorization server `issuer` with
validated `metadata`.

## Options

  * `:redirect_uri` - the redirect URI of the flow (needed to register).
  * `:register` - whether dynamic registration may send a request
    (default `true`; `false` only reuses a stored registration, as a
    token refresh does).

---

*Consult [api-reference.md](api-reference.md) for complete listing*