coder · BobbyHo · Jul 28, 2026 · Jul 16, 2026 · Jul 17, 2026 · Jul 17, 2026
diff --git a/cli/oauth2provider.go b/cli/oauth2provider.go
@@ -0,0 +1,96 @@
+package cli
+
+import (
+	"fmt"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/serpent"
+)
+
+func (r *RootCmd) oauth2Provider() *serpent.Command {
+	cmd := &serpent.Command{
+		Use:   "oauth2-provider",
+		Short: "Manage Coder OAuth2 provider settings",
+		Long: "Administrators can use these commands to change OAuth2 provider settings.\n" + FormatExamples(
+			Example{
+				Description: "Enable dynamic client registration (RFC 7591), allowing OAuth2/MCP clients to self-register without an admin creating an app first",
+				Command:     "coder oauth2-provider dcr enable",
+			},
+			Example{
+				Description: "Disable dynamic client registration. Clients that already registered are unaffected; only new self-registration attempts are rejected",
+				Command:     "coder oauth2-provider dcr disable",
+			},
+		),
+		Handler: func(inv *serpent.Invocation) error {
+			return inv.Command.HelpHandler(inv)
+		},
+		Children: []*serpent.Command{
+			r.oauth2ProviderDCR(),
+		},
+	}
+	return cmd
+}
+
+func (r *RootCmd) oauth2ProviderDCR() *serpent.Command {
+	cmd := &serpent.Command{
+		Use:   "dcr",
+		Short: "Manage OAuth2 dynamic client registration (RFC 7591)",
+		Handler: func(inv *serpent.Invocation) error {
+			return inv.Command.HelpHandler(inv)
+		},
+		Children: []*serpent.Command{
+			r.oauth2ProviderDCRToggle(dcrToggleEnable),
+			r.oauth2ProviderDCRToggle(dcrToggleDisable),
+		},
+	}
+	return cmd
+}
+
+// dcrToggleAction distinguishes the "enable" and "disable" subcommands of
+// `coder oauth2-provider dcr`, which are otherwise identical.
+type dcrToggleAction int
+
+const (
+	dcrToggleDisable dcrToggleAction = iota
+	dcrToggleEnable
+)
+
+func (r *RootCmd) oauth2ProviderDCRToggle(action dcrToggleAction) *serpent.Command {
+	enabled := action == dcrToggleEnable
+	use, short, verb := "disable", "Disable OAuth2 dynamic client registration", "disable"
+	if enabled {
+		use, short, verb = "enable", "Enable OAuth2 dynamic client registration", "enable"
+	}
+
+	cmd := &serpent.Command{
+		Use:   use,
+		Short: short,
+		Middleware: serpent.Chain(
+			serpent.RequireNArgs(0),
+		),
+		Handler: func(inv *serpent.Invocation) error {
+			client, err := r.InitClient(inv)
+			if err != nil {
+				return err
+			}
+
+			_, err = client.PutOAuth2ProviderSettings(inv.Context(), codersdk.OAuth2ProviderSettings{
+				DynamicClientRegistrationEnabled: ptr.Ref(enabled),
+			})
+			if err != nil {
+				return xerrors.Errorf("unable to %s dynamic client registration: %w", verb, err)
+			}
+
+			state := "disabled"
+			if enabled {
+				state = "enabled"
+			}
+			_, _ = fmt.Fprintf(inv.Stderr, "Dynamic client registration is now %s.\n", state)
+			return nil
+		},
+	}
+	return cmd
+}
diff --git a/cli/oauth2provider_test.go b/cli/oauth2provider_test.go
@@ -0,0 +1,82 @@
+package cli_test
+
+import (
+	"bytes"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestOAuth2ProviderDCR(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name        string
+		command     string
+		expectValue bool
+		expectMsg   string
+	}{
+		{
+			name:        "Enable",
+			command:     "enable",
+			expectValue: true,
+			expectMsg:   "Dynamic client registration is now enabled.",
+		},
+		{
+			name:        "Disable",
+			command:     "disable",
+			expectValue: false,
+			expectMsg:   "Dynamic client registration is now disabled.",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			_ = coderdtest.CreateFirstUser(t, client)
+
+			inv, root := clitest.New(t, "oauth2-provider", "dcr", tt.command)
+			clitest.SetupConfig(t, client, root)
+
+			var buf bytes.Buffer
+			inv.Stderr = &buf
+			err := inv.Run()
+			require.NoError(t, err)
+			assert.Contains(t, buf.String(), tt.expectMsg)
+
+			ctx := testutil.Context(t, testutil.WaitShort)
+			settings, err := client.OAuth2ProviderSettings(ctx)
+			require.NoError(t, err)
+			require.NotNil(t, settings.DynamicClientRegistrationEnabled, "GET must always return a concrete value")
+			require.Equal(t, tt.expectValue, *settings.DynamicClientRegistrationEnabled)
+		})
+	}
+}
+
+func TestOAuth2ProviderDCR_RegularUser(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, nil)
+	owner := coderdtest.CreateFirstUser(t, client)
+	anotherClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+	inv, root := clitest.New(t, "oauth2-provider", "dcr", "enable")
+	clitest.SetupConfig(t, anotherClient, root)
+
+	var buf bytes.Buffer
+	inv.Stderr = &buf
+	err := inv.Run()
+	var sdkError *codersdk.Error
+	require.Error(t, err)
+	require.ErrorAsf(t, err, &sdkError, "error should be of type *codersdk.Error")
+	assert.Equal(t, http.StatusForbidden, sdkError.StatusCode())
+}
diff --git a/cli/root.go b/cli/root.go
@@ -109,6 +109,7 @@ func (r *RootCmd) CoreSubcommands() []*serpent.Command {
 		r.logout(),
 		r.netcheck(),
 		r.notifications(),
+		r.oauth2Provider(),
 		r.organizations(),
 		r.portForward(),
 		r.publickey(),

diff --git a/cli/testdata/coder_--help.golden b/cli/testdata/coder_--help.golden
@@ -14,57 +14,58 @@ USAGE:
        $ coder templates init
 
 SUBCOMMANDS:
-    autoupdate        Toggle auto-update policy for a workspace
-    completion        Install or update shell completion scripts for the
-                      detected or chosen shell.
-    config-ssh        Add an SSH Host entry for your workspaces "ssh
-                      workspace.coder"
-    create            Create a workspace
-    delete            Delete a workspace
-    dotfiles          Personalize your workspace by applying a canonical
-                      dotfiles repository
-    external-auth     Manage external authentication
-    favorite          Add a workspace to your favorites
-    list              List workspaces
-    login             Authenticate with Coder deployment
-    logout            Unauthenticate your local session
-    logs              View logs for a workspace
-    netcheck          Print network debug information for DERP and STUN
-    notifications     Manage Coder notifications
-    open              Open a workspace
-    organizations     Organization related commands
-    ping              Ping a workspace
-    port-forward      Forward ports from a workspace to the local machine. For
-                      reverse port forwarding, use "coder ssh -R".
-    provisioner       View and manage provisioner daemons and jobs
-    publickey         Output your Coder public key used for Git operations
-    rename            Rename a workspace
-    reset-password    Directly connect to the database to reset a user's
-                      password
-    restart           Restart a workspace
-    schedule          Schedule automated start and stop times for workspaces
-    secret            Manage secrets
-    server            Start a Coder server
-    show              Display details of a workspace's resources and agents
-    speedtest         Run upload and download tests from your machine to a
-                      workspace
-    ssh               Start a shell into a workspace or run a command
-    start             Start a workspace
-    stat              Show resource usage for the current workspace.
-    state             Manually manage Terraform state to fix broken workspaces
-    stop              Stop a workspace
-    support           Commands for troubleshooting issues with a Coder
-                      deployment.
-    task              Manage tasks
-    templates         Manage templates
-    tokens            Manage personal access tokens
-    unfavorite        Remove a workspace from your favorites
-    update            Will update and start a given workspace if it is out of
-                      date. If the workspace is already running, it will be
-                      stopped first.
-    users             Manage users
-    version           Show coder version
-    whoami            Fetch authenticated user info for Coder deployment
+    autoupdate         Toggle auto-update policy for a workspace
+    completion         Install or update shell completion scripts for the
+                       detected or chosen shell.
+    config-ssh         Add an SSH Host entry for your workspaces "ssh
+                       workspace.coder"
+    create             Create a workspace
+    delete             Delete a workspace
+    dotfiles           Personalize your workspace by applying a canonical
+                       dotfiles repository
+    external-auth      Manage external authentication
+    favorite           Add a workspace to your favorites
+    list               List workspaces
+    login              Authenticate with Coder deployment
+    logout             Unauthenticate your local session
+    logs               View logs for a workspace
+    netcheck           Print network debug information for DERP and STUN
+    notifications      Manage Coder notifications
+    oauth2-provider    Manage Coder OAuth2 provider settings
+    open               Open a workspace
+    organizations      Organization related commands
+    ping               Ping a workspace
+    port-forward       Forward ports from a workspace to the local machine. For
+                       reverse port forwarding, use "coder ssh -R".
+    provisioner        View and manage provisioner daemons and jobs
+    publickey          Output your Coder public key used for Git operations
+    rename             Rename a workspace
+    reset-password     Directly connect to the database to reset a user's
+                       password
+    restart            Restart a workspace
+    schedule           Schedule automated start and stop times for workspaces
+    secret             Manage secrets
+    server             Start a Coder server
+    show               Display details of a workspace's resources and agents
+    speedtest          Run upload and download tests from your machine to a
+                       workspace
+    ssh                Start a shell into a workspace or run a command
+    start              Start a workspace
+    stat               Show resource usage for the current workspace.
+    state              Manually manage Terraform state to fix broken workspaces
+    stop               Stop a workspace
+    support            Commands for troubleshooting issues with a Coder
+                       deployment.
+    task               Manage tasks
+    templates          Manage templates
+    tokens             Manage personal access tokens
+    unfavorite         Remove a workspace from your favorites
+    update             Will update and start a given workspace if it is out of
+                       date. If the workspace is already running, it will be
+                       stopped first.
+    users              Manage users
+    version            Show coder version
+    whoami             Fetch authenticated user info for Coder deployment
 
 GLOBAL OPTIONS: 
 Global options are applied to all commands. They can be set using environment

diff --git a/cli/testdata/coder_oauth2-provider_--help.golden b/cli/testdata/coder_oauth2-provider_--help.golden
@@ -0,0 +1,24 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder oauth2-provider
+
+  Manage Coder OAuth2 provider settings
+
+  Administrators can use these commands to change OAuth2 provider settings.
+    - Enable dynamic client registration (RFC 7591), allowing OAuth2/MCP clients
+  to
+  self-register without an admin creating an app first:
+
+       $ coder oauth2-provider dcr enable
+
+    - Disable dynamic client registration. Clients that already registered are
+  unaffected; only new self-registration attempts are rejected:
+
+       $ coder oauth2-provider dcr disable
+
+SUBCOMMANDS:
+    dcr    Manage OAuth2 dynamic client registration (RFC 7591)
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_oauth2-provider_dcr_--help.golden b/cli/testdata/coder_oauth2-provider_dcr_--help.golden
@@ -0,0 +1,13 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder oauth2-provider dcr
+
+  Manage OAuth2 dynamic client registration (RFC 7591)
+
+SUBCOMMANDS:
+    disable    Disable OAuth2 dynamic client registration
+    enable     Enable OAuth2 dynamic client registration
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_oauth2-provider_dcr_disable_--help.golden b/cli/testdata/coder_oauth2-provider_dcr_disable_--help.golden
@@ -0,0 +1,9 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder oauth2-provider dcr disable
+
+  Disable OAuth2 dynamic client registration
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_oauth2-provider_dcr_enable_--help.golden b/cli/testdata/coder_oauth2-provider_dcr_enable_--help.golden
@@ -0,0 +1,9 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder oauth2-provider dcr enable
+
+  Enable OAuth2 dynamic client registration
+
+———
+Run `coder --help` for a list of global options.