Hello, I am trying to run through the MCP OAuth protocol to register a client on the Figma remote MCP server, running into an issue when calling the registration endpoint.

After discovering the registration endpoint via the /.well_known/oauth-authorization-server call, I call the registration endpoint via:

curl -sS -v -X POST "$REG_ENDPOINT" -H "Content-Type: application/json" -d '{
    "redirect_uris": ["http://127.0.0.1:53195/callback"],
    "grant_types": ["authorization_code","refresh_token"],
    "response_types": ["code"],
    "token_endpoint_auth_method": "none"
  }'

I get back from this a “Forbidden” response and without this response I can’t continue the OAuth protocol.

Does client registration have limitations to prevent it from working on different domains and url callbacks at the moment? I am doing this in a context outside of Claude, Cursor, etc..