Agentic Data Plane
Preview

rpk ai oauth-client dcr

Manage Dynamic Client Registration (DCR) settings for the AI gateway. DCR allows OAuth clients to register themselves programmatically at a public endpoint.

When DCR is enabled, spec-conformant MCP clients (such as Claude and Cursor) self-register at the public /oauth/idp/register endpoint with no admin pre-provisioning. Admission is governed by the mode:

  • open: anyone may register (rate limit and client cap still apply)

  • initial-access-token: callers must present an admin-minted one-shot bearer token

  • software-statement: reserved, not yet supported

DCR is disabled per tenant by default. The gateway operator must also enable the global ingress.idp.dcr.global_enabled flag.

Usage

rpk ai oauth-client dcr [flags]

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.