RFC 7591 dynamic client registration. Without an Authorization bearer the registration is anonymous and creates a public client (token_endpoint_auth_method must be none), which is how MCP clients such as Claude Code register themselves. With an initial access token as the bearer the client is Person-owned, may be confidential (client_secret_basic), and is limited to the token's scope ceiling. Either way the response carries a registration access token for RFC 7592 management.