--- title: Customize dynamic client registration description: Configure PingAM to run a script after processing dynamic client registration requests to modify client profiles and create client relationships component: pingam version: 8 page_id: pingam:am-oidc1:dynamic-client-registration-script canonical_url: https://docs.pingidentity.com/pingam/8.1/am-oidc1/dynamic-client-registration-script.html llms_txt: https://docs.pingidentity.com/pingam/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-06-01T14:34:20Z keywords: ["OpenID Connect (OIDC)", "Setup & Configuration", "Scripts"] page_aliases: ["oidc1-guide:dynamic-client-registration-script.adoc"] superseded_by: https://docs.pingidentity.com/pingam/8.1/am-oidc1/dynamic-client-registration-script.html section_ids: dcr-create-script: Create a script dcr-configure-provider: Configure OAuth 2.0 provider to use the script dcr-test: Test your changes dcr-scripting-api: Dynamic client registration scripting API --- # Customize dynamic client registration You can configure AM to run a script after it has processed a dynamic client registration request. This scripted extension point lets you perform custom actions to modify the client profile, for example, by updating client attributes or manipulating PingIDM data to create client relationships. The script is called after the following dynamic client registration operations: * [Create](oauth2-dynamic-client-registration.html#dynamic-registration-options) * [Update](oauth2-dynamic-client-registration.html#dynamic-management-update) * [Delete](oauth2-dynamic-client-registration.html#dynamic-management-delete) ## Create a script AM includes [a sample script](../am-scripting/sample-scripts.html#oauth2-dynamic-client-registration-js) that updates client attributes with values from the request. You can use this as a template to create your own custom script. 1. In the AM admin UI, [create a script](../am-scripting/manage-scripts-console.html#create-scripts-with-console) with the Script Type set to `OAuth2 Dynamic Client Registration`. 2. Write your own or copy the sample script into the Script field. A dynamic client registration script is a [next-generation](../am-scripting/next-generation-scripts.html) script. You have access to all [common](../am-scripting/script-bindings.html) next-generation bindings, such as `openidm`, `httpClient`, and `utils`, to help you modify the client profile. Learn about the bindings you can use in the [Dynamic client registration scripting API](#dcr-scripting-api). 3. Save your changes. ## Configure OAuth 2.0 provider to use the script After creating your script, you must configure AM to use it. 1. In the AM admin UI, go to Realms > *realm name* > Services > OAuth2 Provider > Client Dynamic Registration to configure a specific OAuth 2.0 provider. To set your script as the default for all new OAuth 2.0 providers, go to Configure > Global Services > OAuth2 Provider > Client Dynamic Registration. 2. Set Dynamic Client Registration Script to the script name you want to use. 3. Save your changes. ## Test your changes 1. Perform a request to register, update, or delete a client profile dynamically. 2. The provider runs the script after the operation completes successfully. *The script isn't invoked if the operation fails.* 3. Verify that the script makes the changes as expected. For the sample script, check for the following modifications depending on the type of request: * `CREATE` operation The script sets the client attribute `com.forgerock.openam.oauth2provider.grantTypes` to `authorization_code` and the grant type for the request. * `UPDATE` operation The script adds the software statement's `redirect_uris` property to the client attribute `com.forgerock.openam.oauth2provider.redirectionURIs`. * `DELETE operation` The script makes no changes. | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The property names used to update client attributes, such as `com.forgerock.openam.oauth2provider.grantTypes`, are PingDS properties and don't map to the property names found by querying the [/realm-config/agents/OAuth2Client](../am-oauth2/rest-api-oauth2-client-admin-endpoint.html#query-oauth2-clients) endpoint. | ## Dynamic client registration scripting API | | | | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The dynamic client registration script is a next-generation script and, therefore, has access to all the *next-generation* [common bindings](../am-scripting/script-bindings.html) in addition to those described here. | | Binding | Description | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `requestProperties` | A map of the properties in the request. Always present.The keys in the map are as follows:- `requestUri`: The URI of the request. - `realm`: The realm where the request was made. - `requestParams`: The request parameters and posted data where each value is a list of one or more properties. - `requestHeaders`: A map of the request headers. Header names are case-sensitive. - `requestBody`: A map representing the body of the request. To mitigate the risk of reflection-type attacks, use OWASP best practices when handling these properties. For example, see Unsafe use of Reflection. | | `operation` | The dynamic client registration request operation as a String. Possible values: `CREATE`, `UPDATE`, and `DELETE`. | | `clientIdentity` | The [ScriptedIdentity](../_attachments/apidocs/org/forgerock/openam/scripting/api/identity/ScriptedIdentity.html) that represents the created or updated client. This binding is null if the operation is DELETE. | | `softwareStatement` | A map representing the *decoded* JWT of the [software statement](oauth2-dynamic-client-registration.html#registration-software-statement) from the request, including the issuer and required claims.This is an empty map if no software statement is provided. |