@@ -24,6 +24,7 @@ This command starts a standalone proxy without creating a workload, providing:
2424- Automatic authentication detection via WWW-Authenticate headers
2525- OIDC-based access control for incoming proxy requests
2626- Secure credential handling via files or environment variables
27+ - Dynamic client registration (RFC 7591) for automatic OAuth client setup
2728
2829#### Authentication modes
2930
@@ -42,6 +43,15 @@ OAuth client secrets can be provided via (in order of precedence):
42432 . --remote-auth-client-secret-file flag (secure file-based approach)
43443 . TOOLHIVE_REMOTE_OAUTH_CLIENT_SECRET environment variable
4445
46+ #### Dynamic client registration
47+
48+ When no client credentials are provided, the proxy automatically registers an OAuth client
49+ with the authorization server using RFC 7591 dynamic client registration:
50+
51+ - No need to pre-configure client ID and secret
52+ - Automatically discovers registration endpoint via OIDC
53+ - Supports PKCE flow for enhanced security
54+
4555#### Examples
4656
4757Basic transparent proxy:
@@ -75,6 +85,11 @@ Auto-detect authentication requirements:
7585 thv proxy my-server --target-uri https://protected-api.com \
7686 --remote-auth-client-id my-client-id
7787
88+ Dynamic client registration (automatic OAuth client setup):
89+
90+ thv proxy my-server --target-uri https://protected-api.com \
91+ --remote-auth --remote-auth-issuer https://auth.example.com
92+
7893```
7994thv proxy [flags] SERVER_NAME
8095```
0 commit comments