Agentic Data Plane

rpk ai oauth-client dcr

Manage Dynamic Client Registration (DCR) settings for the AI gateway. DCR allows OAuth clients to register themselves programmatically at a public endpoint.

When DCR is enabled, spec-conformant MCP clients (such as Claude and Cursor) self-register at the public /oauth/idp/register endpoint with no admin pre-provisioning. Admission is governed by the mode:

  • open: anyone may register (rate limit and client cap still apply)

  • initial-access-token: callers must present an admin-minted one-shot bearer token

  • software-statement: reserved, not yet supported

DCR is disabled per tenant by default. The gateway operator must also enable the global ingress.idp.dcr.global_enabled flag.

Usage

rpk ai oauth-client dcr [flags]

Subcommands

Command Description

rpk ai oauth-client dcr get

Show the Dynamic Client Registration (DCR) settings for the current tenant, including whether DCR is enabled and the configured admission mode.

rpk ai oauth-client dcr iat

Manage Initial Access Tokens (IATs): one-shot bearer credentials a caller presents to the public registration endpoint when the tenant’s admission mode is initial-access-token. The plaintext is printed exactly once on mint; only a hash is stored.

rpk ai oauth-client dcr update

Update the tenant’s DCR settings. Only the flags you pass change; everything else keeps its current value (the CLI reads the current settings and writes back the merged result).

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.