identityserver-dcr

Configure a protected Dynamic Client Registration endpoint for Duende IdentityServer.

10|2|Updated Mar 16, 2026

Search Tags:#authorization #security #oauth #dynamic #dcr #identityserver #openId-connect

Ready to run

npx skills add https://github.com/DuendeSoftware/duende-skills --skill identityserver-dcr

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: identityserver-dcr
Source: https://github.com/DuendeSoftware/duende-skills/tree/main/skills/identityserver-dcr
Command: npx skills add https://github.com/DuendeSoftware/duende-skills --skill identityserver-dcr

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Dynamic Client Registration (DCR) enables clients to register themselves at a protected /connect/dcr endpoint, with enforced policies and secure hosting to prevent misconfigurations.

Core Features & Use Cases

Secure the /connect/dcr endpoint with a policy-based authorization mechanism.
Customize client validation and defaults using DynamicClientRegistrationValidator.
Support software statements for pre-approved client metadata and optional separation of the DCR host from IdentityServer.
Persist dynamically registered clients via IClientConfigurationStore for production reliability.

Quick Start

Enable IdentityServerConfiguration, secure /connect/dcr with an authorization policy, and wire a persistent IClientConfigurationStore to begin dynamically registering clients.

Frequently Asked Questions about identityserver-dcr

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I secure a Dynamic Client Registration endpoint in IdentityServer?▼

To secure Dynamic Client Registration, apply a policy-based authorization mechanism to the /connect/dcr endpoint. This protects client registration with enforced policies to prevent misconfigurations and unauthorized access.

Can I customize client validation and defaults during OAuth DCR?▼

Yes, you can customize client validation and defaults during OAuth DCR by customizing the DynamicClientRegistrationValidator. This allows you to enforce specific validation rules and apply pre-approved client metadata.

How do software statements work with OpenID Connect Dynamic Client Registration?▼

Software statements provide pre-approved client metadata for OpenID Connect Dynamic Client Registration. They allow clients to register themselves at a protected endpoint while ensuring the submitted metadata meets your authorization requirements.

How do I persist dynamically registered OAuth clients for production reliability?▼

Persist dynamically registered OAuth clients by wiring a persistent IClientConfigurationStore. This ensures that registered client configurations are safely stored and remain available across application restarts.

Can I host the Dynamic Client Registration endpoint separately from IdentityServer?▼

Yes, you can optionally separate the Dynamic Client Registration host from IdentityServer. This secure DCR hosting pattern allows you to isolate the registration endpoint while maintaining central configuration.

What do I need to enable Dynamic Client Registration in Duende IdentityServer?▼

To enable Dynamic Client Registration in Duende IdentityServer, you must enable AddIdentityServerConfiguration, secure the /connect/dcr endpoint with an authorization policy, and wire a persistent IClientConfigurationStore.