diff --git a/.claude/docs/DATABASE.md b/.claude/docs/DATABASE.md
new file mode 100644
index 0000000000000..f6ba4bd78859b
--- /dev/null
+++ b/.claude/docs/DATABASE.md
@@ -0,0 +1,258 @@
+# Database Development Patterns
+
+## Database Work Overview
+
+### Database Generation Process
+
+1. Modify SQL files in `coderd/database/queries/`
+2. Run `make gen`
+3. If errors about audit table, update `enterprise/audit/table.go`
+4. Run `make gen` again
+5. Run `make lint` to catch any remaining issues
+
+## Migration Guidelines
+
+### Creating Migration Files
+
+**Location**: `coderd/database/migrations/`
+**Format**: `{number}_{description}.{up|down}.sql`
+
+- Number must be unique and sequential
+- Always include both up and down migrations
+
+### Helper Scripts
+
+| Script | Purpose |
+|--------|---------|
+| `./coderd/database/migrations/create_migration.sh "migration name"` | Creates new migration files |
+| `./coderd/database/migrations/fix_migration_numbers.sh` | Renumbers migrations to avoid conflicts |
+| `./coderd/database/migrations/create_fixture.sh "fixture name"` | Creates test fixtures for migrations |
+
+### Database Query Organization
+
+- **MUST DO**: Any changes to database - adding queries, modifying queries should be done in the `coderd/database/queries/*.sql` files
+- **MUST DO**: Queries are grouped in files relating to context - e.g. `prebuilds.sql`, `users.sql`, `oauth2.sql`
+- After making changes to any `coderd/database/queries/*.sql` files you must run `make gen` to generate respective ORM changes
+
+## Handling Nullable Fields
+
+Use `sql.NullString`, `sql.NullBool`, etc. for optional database fields:
+
+```go
+CodeChallenge: sql.NullString{
+    String: params.codeChallenge,
+    Valid:  params.codeChallenge != "",
+}
+```
+
+Set `.Valid = true` when providing values.
+
+## Audit Table Updates
+
+If adding fields to auditable types:
+
+1. Update `enterprise/audit/table.go`
+2. Add each new field with appropriate action:
+   - `ActionTrack`: Field should be tracked in audit logs
+   - `ActionIgnore`: Field should be ignored in audit logs
+   - `ActionSecret`: Field contains sensitive data
+3. Run `make gen` to verify no audit errors
+
+## In-Memory Database (dbmem) Updates
+
+### Critical Requirements
+
+When adding new fields to database structs:
+
+- **CRITICAL**: Update `coderd/database/dbmem/dbmem.go` in-memory implementations
+- The `Insert*` functions must include ALL new fields, not just basic ones
+- Common issue: Tests pass with real database but fail with in-memory database due to missing field mappings
+- Always verify in-memory database functions match the real database schema after migrations
+
+### Example Pattern
+
+```go
+// In dbmem.go - ensure ALL fields are included
+code := database.OAuth2ProviderAppCode{
+    ID:                  arg.ID,
+    CreatedAt:           arg.CreatedAt,
+    // ... existing fields ...
+    ResourceUri:         arg.ResourceUri,         // New field
+    CodeChallenge:       arg.CodeChallenge,       // New field
+    CodeChallengeMethod: arg.CodeChallengeMethod, // New field
+}
+```
+
+## Database Architecture
+
+### Core Components
+
+- **PostgreSQL 13+** recommended for production
+- **Migrations** managed with `migrate`
+- **Database authorization** through `dbauthz` package
+
+### Authorization Patterns
+
+```go
+// Public endpoints needing system access (OAuth2 registration)
+app, err := api.Database.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID)
+
+// Authenticated endpoints with user context
+app, err := api.Database.GetOAuth2ProviderAppByClientID(ctx, clientID)
+
+// System operations in middleware
+roles, err := db.GetAuthorizationUserRoles(dbauthz.AsSystemRestricted(ctx), userID)
+```
+
+## Common Database Issues
+
+### Migration Issues
+
+1. **Migration conflicts**: Use `fix_migration_numbers.sh` to renumber
+2. **Missing down migration**: Always create both up and down files
+3. **Schema inconsistencies**: Verify against existing schema
+
+### Field Handling Issues
+
+1. **Nullable field errors**: Use `sql.Null*` types consistently
+2. **Missing audit entries**: Update `enterprise/audit/table.go`
+3. **dbmem inconsistencies**: Ensure in-memory implementations match schema
+
+### Query Issues
+
+1. **Query organization**: Group related queries in appropriate files
+2. **Generated code errors**: Run `make gen` after query changes
+3. **Performance issues**: Add appropriate indexes in migrations
+
+## Database Testing
+
+### Test Database Setup
+
+```go
+func TestDatabaseFunction(t *testing.T) {
+    db := dbtestutil.NewDB(t)
+
+    // Test with real database
+    result, err := db.GetSomething(ctx, param)
+    require.NoError(t, err)
+    require.Equal(t, expected, result)
+}
+```
+
+### In-Memory Testing
+
+```go
+func TestInMemoryDatabase(t *testing.T) {
+    db := dbmem.New()
+
+    // Test with in-memory database
+    result, err := db.GetSomething(ctx, param)
+    require.NoError(t, err)
+    require.Equal(t, expected, result)
+}
+```
+
+## Best Practices
+
+### Schema Design
+
+1. **Use appropriate data types**: VARCHAR for strings, TIMESTAMP for times
+2. **Add constraints**: NOT NULL, UNIQUE, FOREIGN KEY as appropriate
+3. **Create indexes**: For frequently queried columns
+4. **Consider performance**: Normalize appropriately but avoid over-normalization
+
+### Query Writing
+
+1. **Use parameterized queries**: Prevent SQL injection
+2. **Handle errors appropriately**: Check for specific error types
+3. **Use transactions**: For related operations that must succeed together
+4. **Optimize queries**: Use EXPLAIN to understand query performance
+
+### Migration Writing
+
+1. **Make migrations reversible**: Always include down migration
+2. **Test migrations**: On copy of production data if possible
+3. **Keep migrations small**: One logical change per migration
+4. **Document complex changes**: Add comments explaining rationale
+
+## Advanced Patterns
+
+### Complex Queries
+
+```sql
+-- Example: Complex join with aggregation
+SELECT
+    u.id,
+    u.username,
+    COUNT(w.id) as workspace_count
+FROM users u
+LEFT JOIN workspaces w ON u.id = w.owner_id
+WHERE u.created_at > $1
+GROUP BY u.id, u.username
+ORDER BY workspace_count DESC;
+```
+
+### Conditional Queries
+
+```sql
+-- Example: Dynamic filtering
+SELECT * FROM oauth2_provider_apps
+WHERE
+    ($1::text IS NULL OR name ILIKE '%' || $1 || '%')
+    AND ($2::uuid IS NULL OR organization_id = $2)
+ORDER BY created_at DESC;
+```
+
+### Audit Patterns
+
+```go
+// Example: Auditable database operation
+func (q *sqlQuerier) UpdateUser(ctx context.Context, arg UpdateUserParams) (User, error) {
+    // Implementation here
+
+    // Audit the change
+    if auditor := audit.FromContext(ctx); auditor != nil {
+        auditor.Record(audit.UserUpdate{
+            UserID: arg.ID,
+            Old:    oldUser,
+            New:    newUser,
+        })
+    }
+
+    return newUser, nil
+}
+```
+
+## Debugging Database Issues
+
+### Common Debug Commands
+
+```bash
+# Check database connection
+make test-postgres
+
+# Run specific database tests
+go test ./coderd/database/... -run TestSpecificFunction
+
+# Check query generation
+make gen
+
+# Verify audit table
+make lint
+```
+
+### Debug Techniques
+
+1. **Enable query logging**: Set appropriate log levels
+2. **Use database tools**: pgAdmin, psql for direct inspection
+3. **Check constraints**: UNIQUE, FOREIGN KEY violations
+4. **Analyze performance**: Use EXPLAIN ANALYZE for slow queries
+
+### Troubleshooting Checklist
+
+- [ ] Migration files exist (both up and down)
+- [ ] `make gen` run after query changes
+- [ ] Audit table updated for new fields
+- [ ] In-memory database implementations updated
+- [ ] Nullable fields use `sql.Null*` types
+- [ ] Authorization context appropriate for endpoint type
diff --git a/.claude/docs/OAUTH2.md b/.claude/docs/OAUTH2.md
new file mode 100644
index 0000000000000..2c766dd083516
--- /dev/null
+++ b/.claude/docs/OAUTH2.md
@@ -0,0 +1,159 @@
+# OAuth2 Development Guide
+
+## RFC Compliance Development
+
+### Implementing Standard Protocols
+
+When implementing standard protocols (OAuth2, OpenID Connect, etc.):
+
+1. **Fetch and Analyze Official RFCs**:
+   - Always read the actual RFC specifications before implementation
+   - Use WebFetch tool to get current RFC content for compliance verification
+   - Document RFC requirements in code comments
+
+2. **Default Values Matter**:
+   - Pay close attention to RFC-specified default values
+   - Example: RFC 7591 specifies `client_secret_basic` as default, not `client_secret_post`
+   - Ensure consistency between database migrations and application code
+
+3. **Security Requirements**:
+   - Follow RFC security considerations precisely
+   - Example: RFC 7592 prohibits returning registration access tokens in GET responses
+   - Implement proper error responses per protocol specifications
+
+4. **Validation Compliance**:
+   - Implement comprehensive validation per RFC requirements
+   - Support protocol-specific features (e.g., custom schemes for native OAuth2 apps)
+   - Test edge cases defined in specifications
+
+## OAuth2 Provider Implementation
+
+### OAuth2 Spec Compliance
+
+1. **Follow RFC 6749 for token responses**
+   - Use `expires_in` (seconds) not `expiry` (timestamp) in token responses
+   - Return proper OAuth2 error format: `{"error": "code", "error_description": "details"}`
+
+2. **Error Response Format**
+   - Create OAuth2-compliant error responses for token endpoint
+   - Use standard error codes: `invalid_client`, `invalid_grant`, `invalid_request`
+   - Avoid generic error responses for OAuth2 endpoints
+
+### PKCE Implementation
+
+- Support both with and without PKCE for backward compatibility
+- Use S256 method for code challenge
+- Properly validate code_verifier against stored code_challenge
+
+### UI Authorization Flow
+
+- Use POST requests for consent, not GET with links
+- Avoid dependency on referer headers for security decisions
+- Support proper state parameter validation
+
+### RFC 8707 Resource Indicators
+
+- Store resource parameters in database for server-side validation (opaque tokens)
+- Validate resource consistency between authorization and token requests
+- Support audience validation in refresh token flows
+- Resource parameter is optional but must be consistent when provided
+
+## OAuth2 Error Handling Pattern
+
+```go
+// Define specific OAuth2 errors
+var (
+    errInvalidPKCE = xerrors.New("invalid code_verifier")
+)
+
+// Use OAuth2-compliant error responses
+type OAuth2Error struct {
+    Error            string `json:"error"`
+    ErrorDescription string `json:"error_description,omitempty"`
+}
+
+// Return proper OAuth2 errors
+if errors.Is(err, errInvalidPKCE) {
+    writeOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_grant", "The PKCE code verifier is invalid")
+    return
+}
+```
+
+## Testing OAuth2 Features
+
+### Test Scripts
+
+Located in `./scripts/oauth2/`:
+
+- `test-mcp-oauth2.sh` - Full automated test suite
+- `setup-test-app.sh` - Create test OAuth2 app
+- `cleanup-test-app.sh` - Remove test app
+- `generate-pkce.sh` - Generate PKCE parameters
+- `test-manual-flow.sh` - Manual browser testing
+
+Always run the full test suite after OAuth2 changes:
+
+```bash
+./scripts/oauth2/test-mcp-oauth2.sh
+```
+
+### RFC Protocol Testing
+
+1. **Compliance Test Coverage**:
+   - Test all RFC-defined error codes and responses
+   - Validate proper HTTP status codes for different scenarios
+   - Test protocol-specific edge cases (URI formats, token formats, etc.)
+
+2. **Security Boundary Testing**:
+   - Test client isolation and privilege separation
+   - Verify information disclosure protections
+   - Test token security and proper invalidation
+
+## Common OAuth2 Issues
+
+1. **OAuth2 endpoints returning wrong error format** - Ensure OAuth2 endpoints return RFC 6749 compliant errors
+2. **OAuth2 tests failing but scripts working** - Check in-memory database implementations in `dbmem.go`
+3. **Resource indicator validation failing** - Ensure database stores and retrieves resource parameters correctly
+4. **PKCE tests failing** - Verify both authorization code storage and token exchange handle PKCE fields
+5. **RFC compliance failures** - Verify against actual RFC specifications, not assumptions
+6. **Authorization context errors in public endpoints** - Use `dbauthz.AsSystemRestricted(ctx)` pattern
+7. **Default value mismatches** - Ensure database migrations match application code defaults
+8. **Bearer token authentication issues** - Check token extraction precedence and format validation
+9. **URI validation failures** - Support both standard schemes and custom schemes per protocol requirements
+
+## Authorization Context Patterns
+
+```go
+// Public endpoints needing system access (OAuth2 registration)
+app, err := api.Database.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID)
+
+// Authenticated endpoints with user context
+app, err := api.Database.GetOAuth2ProviderAppByClientID(ctx, clientID)
+
+// System operations in middleware
+roles, err := db.GetAuthorizationUserRoles(dbauthz.AsSystemRestricted(ctx), userID)
+```
+
+## OAuth2/Authentication Work Patterns
+
+- Types go in `codersdk/oauth2.go` or similar
+- Handlers go in `coderd/oauth2.go` or `coderd/identityprovider/`
+- Database fields need migration + audit table updates
+- Always support backward compatibility
+
+## Protocol Implementation Checklist
+
+Before completing OAuth2 or authentication feature work:
+
+- [ ] Verify RFC compliance by reading actual specifications
+- [ ] Implement proper error response formats per protocol
+- [ ] Add comprehensive validation for all protocol fields
+- [ ] Test security boundaries and token handling
+- [ ] Update RBAC permissions for new resources
+- [ ] Add audit logging support if applicable
+- [ ] Create database migrations with proper defaults
+- [ ] Update in-memory database implementations
+- [ ] Add comprehensive test coverage including edge cases
+- [ ] Verify linting compliance
+- [ ] Test both positive and negative scenarios
+- [ ] Document protocol-specific patterns and requirements
diff --git a/.claude/docs/TESTING.md b/.claude/docs/TESTING.md
new file mode 100644
index 0000000000000..b8f92f531bb1c
--- /dev/null
+++ b/.claude/docs/TESTING.md
@@ -0,0 +1,239 @@
+# Testing Patterns and Best Practices
+
+## Testing Best Practices
+
+### Avoiding Race Conditions
+
+1. **Unique Test Identifiers**:
+   - Never use hardcoded names in concurrent tests
+   - Use `time.Now().UnixNano()` or similar for unique identifiers
+   - Example: `fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano())`
+
+2. **Database Constraint Awareness**:
+   - Understand unique constraints that can cause test conflicts
+   - Generate unique values for all constrained fields
+   - Test name isolation prevents cross-test interference
+
+### Testing Patterns
+
+- Use table-driven tests for comprehensive coverage
+- Mock external dependencies
+- Test both positive and negative cases
+- Use `testutil.WaitLong` for timeouts in tests
+
+### Test Package Naming
+
+- **Test packages**: Use `package_test` naming (e.g., `identityprovider_test`) for black-box testing
+
+## RFC Protocol Testing
+
+### Compliance Test Coverage
+
+1. **Test all RFC-defined error codes and responses**
+2. **Validate proper HTTP status codes for different scenarios**
+3. **Test protocol-specific edge cases** (URI formats, token formats, etc.)
+
+### Security Boundary Testing
+
+1. **Test client isolation and privilege separation**
+2. **Verify information disclosure protections**
+3. **Test token security and proper invalidation**
+
+## Database Testing
+
+### In-Memory Database Testing
+
+When adding new database fields:
+
+- **CRITICAL**: Update `coderd/database/dbmem/dbmem.go` in-memory implementations
+- The `Insert*` functions must include ALL new fields, not just basic ones
+- Common issue: Tests pass with real database but fail with in-memory database due to missing field mappings
+- Always verify in-memory database functions match the real database schema after migrations
+
+Example pattern:
+
+```go
+// In dbmem.go - ensure ALL fields are included
+code := database.OAuth2ProviderAppCode{
+    ID:                  arg.ID,
+    CreatedAt:           arg.CreatedAt,
+    // ... existing fields ...
+    ResourceUri:         arg.ResourceUri,         // New field
+    CodeChallenge:       arg.CodeChallenge,       // New field
+    CodeChallengeMethod: arg.CodeChallengeMethod, // New field
+}
+```
+
+## Test Organization
+
+### Test File Structure
+
+```
+coderd/
+├── oauth2.go                    # Implementation
+├── oauth2_test.go              # Main tests
+├── oauth2_test_helpers.go      # Test utilities
+└── oauth2_validation.go        # Validation logic
+```
+
+### Test Categories
+
+1. **Unit Tests**: Test individual functions in isolation
+2. **Integration Tests**: Test API endpoints with database
+3. **End-to-End Tests**: Full workflow testing
+4. **Race Tests**: Concurrent access testing
+
+## Test Commands
+
+### Running Tests
+
+| Command | Purpose |
+|---------|---------|
+| `make test` | Run all Go tests |
+| `make test RUN=TestFunctionName` | Run specific test |
+| `go test -v ./path/to/package -run TestFunctionName` | Run test with verbose output |
+| `make test-postgres` | Run tests with Postgres database |
+| `make test-race` | Run tests with Go race detector |
+| `make test-e2e` | Run end-to-end tests |
+
+### Frontend Testing
+
+| Command | Purpose |
+|---------|---------|
+| `pnpm test` | Run frontend tests |
+| `pnpm check` | Run code checks |
+
+## Common Testing Issues
+
+### Database-Related
+
+1. **Tests passing locally but failing in CI** - Check if `dbmem` implementation needs updating
+2. **SQL type errors** - Use `sql.Null*` types for nullable fields
+3. **Race conditions in tests** - Use unique identifiers instead of hardcoded names
+
+### OAuth2 Testing
+
+1. **OAuth2 tests failing but scripts working** - Check in-memory database implementations in `dbmem.go`
+2. **PKCE tests failing** - Verify both authorization code storage and token exchange handle PKCE fields
+3. **Resource indicator validation failing** - Ensure database stores and retrieves resource parameters correctly
+
+### General Issues
+
+1. **Missing newlines** - Ensure files end with newline character
+2. **Package naming errors** - Use `package_test` naming for test files
+3. **Log message formatting errors** - Use lowercase, descriptive messages without special characters
+
+## Systematic Testing Approach
+
+### Multi-Issue Problem Solving
+
+When facing multiple failing tests or complex integration issues:
+
+1. **Identify Root Causes**:
+   - Run failing tests individually to isolate issues
+   - Use LSP tools to trace through call chains
+   - Check both compilation and runtime errors
+
+2. **Fix in Logical Order**:
+   - Address compilation issues first (imports, syntax)
+   - Fix authorization and RBAC issues next
+   - Resolve business logic and validation issues
+   - Handle edge cases and race conditions last
+
+3. **Verification Strategy**:
+   - Test each fix individually before moving to next issue
+   - Use `make lint` and `make gen` after database changes
+   - Verify RFC compliance with actual specifications
+   - Run comprehensive test suites before considering complete
+
+## Test Data Management
+
+### Unique Test Data
+
+```go
+// Good: Unique identifiers prevent conflicts
+clientName := fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano())
+
+// Bad: Hardcoded names cause race conditions
+clientName := "test-client"
+```
+
+### Test Cleanup
+
+```go
+func TestSomething(t *testing.T) {
+    // Setup
+    client := coderdtest.New(t, nil)
+
+    // Test code here
+
+    // Cleanup happens automatically via t.Cleanup() in coderdtest
+}
+```
+
+## Test Utilities
+
+### Common Test Patterns
+
+```go
+// Table-driven tests
+tests := []struct {
+    name     string
+    input    InputType
+    expected OutputType
+    wantErr  bool
+}{
+    {
+        name:     "valid input",
+        input:    validInput,
+        expected: expectedOutput,
+        wantErr:  false,
+    },
+    // ... more test cases
+}
+
+for _, tt := range tests {
+    t.Run(tt.name, func(t *testing.T) {
+        result, err := functionUnderTest(tt.input)
+        if tt.wantErr {
+            require.Error(t, err)
+            return
+        }
+        require.NoError(t, err)
+        require.Equal(t, tt.expected, result)
+    })
+}
+```
+
+### Test Assertions
+
+```go
+// Use testify/require for assertions
+require.NoError(t, err)
+require.Equal(t, expected, actual)
+require.NotNil(t, result)
+require.True(t, condition)
+```
+
+## Performance Testing
+
+### Load Testing
+
+- Use `scaletest/` directory for load testing scenarios
+- Run `./scaletest/scaletest.sh` for performance testing
+
+### Benchmarking
+
+```go
+func BenchmarkFunction(b *testing.B) {
+    for i := 0; i < b.N; i++ {
+        // Function call to benchmark
+        _ = functionUnderTest(input)
+    }
+}
+```
+
+Run benchmarks with:
+```bash
+go test -bench=. -benchmem ./package/path
+```
diff --git a/.claude/docs/TROUBLESHOOTING.md b/.claude/docs/TROUBLESHOOTING.md
new file mode 100644
index 0000000000000..2b4bb3ee064cc
--- /dev/null
+++ b/.claude/docs/TROUBLESHOOTING.md
@@ -0,0 +1,225 @@
+# Troubleshooting Guide
+
+## Common Issues
+
+### Database Issues
+
+1. **"Audit table entry missing action"**
+   - **Solution**: Update `enterprise/audit/table.go`
+   - Add each new field with appropriate action (ActionTrack, ActionIgnore, ActionSecret)
+   - Run `make gen` to verify no audit errors
+
+2. **SQL type errors**
+   - **Solution**: Use `sql.Null*` types for nullable fields
+   - Set `.Valid = true` when providing values
+   - Example:
+
+     ```go
+     CodeChallenge: sql.NullString{
+         String: params.codeChallenge,
+         Valid:  params.codeChallenge != "",
+     }
+     ```
+
+3. **Tests passing locally but failing in CI**
+   - **Solution**: Check if `dbmem` implementation needs updating
+   - Update `coderd/database/dbmem/dbmem.go` for Insert/Update methods
+   - Missing fields in dbmem can cause tests to fail even if main implementation is correct
+
+### Testing Issues
+
+4. **"package should be X_test"**
+   - **Solution**: Use `package_test` naming for test files
+   - Example: `identityprovider_test` for black-box testing
+
+5. **Race conditions in tests**
+   - **Solution**: Use unique identifiers instead of hardcoded names
+   - Example: `fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano())`
+   - Never use hardcoded names in concurrent tests
+
+6. **Missing newlines**
+   - **Solution**: Ensure files end with newline character
+   - Most editors can be configured to add this automatically
+
+### OAuth2 Issues
+
+7. **OAuth2 endpoints returning wrong error format**
+   - **Solution**: Ensure OAuth2 endpoints return RFC 6749 compliant errors
+   - Use standard error codes: `invalid_client`, `invalid_grant`, `invalid_request`
+   - Format: `{"error": "code", "error_description": "details"}`
+
+8. **OAuth2 tests failing but scripts working**
+   - **Solution**: Check in-memory database implementations in `dbmem.go`
+   - Ensure all OAuth2 fields are properly copied in Insert/Update methods
+
+9. **Resource indicator validation failing**
+   - **Solution**: Ensure database stores and retrieves resource parameters correctly
+   - Check both authorization code storage and token exchange handling
+
+10. **PKCE tests failing**
+    - **Solution**: Verify both authorization code storage and token exchange handle PKCE fields
+    - Check `CodeChallenge` and `CodeChallengeMethod` field handling
+
+### RFC Compliance Issues
+
+11. **RFC compliance failures**
+    - **Solution**: Verify against actual RFC specifications, not assumptions
+    - Use WebFetch tool to get current RFC content for compliance verification
+    - Read the actual RFC specifications before implementation
+
+12. **Default value mismatches**
+    - **Solution**: Ensure database migrations match application code defaults
+    - Example: RFC 7591 specifies `client_secret_basic` as default, not `client_secret_post`
+
+### Authorization Issues
+
+13. **Authorization context errors in public endpoints**
+    - **Solution**: Use `dbauthz.AsSystemRestricted(ctx)` pattern
+    - Example:
+
+      ```go
+      // Public endpoints needing system access
+      app, err := api.Database.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID)
+      ```
+
+### Authentication Issues
+
+14. **Bearer token authentication issues**
+    - **Solution**: Check token extraction precedence and format validation
+    - Ensure proper RFC 6750 Bearer Token Support implementation
+
+15. **URI validation failures**
+    - **Solution**: Support both standard schemes and custom schemes per protocol requirements
+    - Native OAuth2 apps may use custom schemes
+
+### General Development Issues
+
+16. **Log message formatting errors**
+    - **Solution**: Use lowercase, descriptive messages without special characters
+    - Follow Go logging conventions
+
+## Systematic Debugging Approach
+
+### Multi-Issue Problem Solving
+
+When facing multiple failing tests or complex integration issues:
+
+1. **Identify Root Causes**:
+   - Run failing tests individually to isolate issues
+   - Use LSP tools to trace through call chains
+   - Check both compilation and runtime errors
+
+2. **Fix in Logical Order**:
+   - Address compilation issues first (imports, syntax)
+   - Fix authorization and RBAC issues next
+   - Resolve business logic and validation issues
+   - Handle edge cases and race conditions last
+
+3. **Verification Strategy**:
+   - Test each fix individually before moving to next issue
+   - Use `make lint` and `make gen` after database changes
+   - Verify RFC compliance with actual specifications
+   - Run comprehensive test suites before considering complete
+
+## Debug Commands
+
+### Useful Debug Commands
+
+| Command | Purpose |
+|---------|---------|
+| `make lint` | Run all linters |
+| `make gen` | Generate mocks, database queries |
+| `go test -v ./path/to/package -run TestName` | Run specific test with verbose output |
+| `go test -race ./...` | Run tests with race detector |
+
+### LSP Debugging
+
+| Command | Purpose |
+|---------|---------|
+| `mcp__go-language-server__definition symbolName` | Find function definition |
+| `mcp__go-language-server__references symbolName` | Find all references |
+| `mcp__go-language-server__diagnostics filePath` | Check for compilation errors |
+
+## Common Error Messages
+
+### Database Errors
+
+**Error**: `pq: relation "oauth2_provider_app_codes" does not exist`
+
+- **Cause**: Missing database migration
+- **Solution**: Run database migrations, check migration files
+
+**Error**: `audit table entry missing action for field X`
+
+- **Cause**: New field added without audit table update
+- **Solution**: Update `enterprise/audit/table.go`
+
+### Go Compilation Errors
+
+**Error**: `package should be identityprovider_test`
+
+- **Cause**: Test package naming convention violation
+- **Solution**: Use `package_test` naming for black-box tests
+
+**Error**: `cannot use X (type Y) as type Z`
+
+- **Cause**: Type mismatch, often with nullable fields
+- **Solution**: Use appropriate `sql.Null*` types
+
+### OAuth2 Errors
+
+**Error**: `invalid_client` but client exists
+
+- **Cause**: Authorization context issue
+- **Solution**: Use `dbauthz.AsSystemRestricted(ctx)` for public endpoints
+
+**Error**: PKCE validation failing
+
+- **Cause**: Missing PKCE fields in database operations
+- **Solution**: Ensure `CodeChallenge` and `CodeChallengeMethod` are handled
+
+## Prevention Strategies
+
+### Before Making Changes
+
+1. **Read the relevant documentation**
+2. **Check if similar patterns exist in codebase**
+3. **Understand the authorization context requirements**
+4. **Plan database changes carefully**
+
+### During Development
+
+1. **Run tests frequently**: `make test`
+2. **Use LSP tools for navigation**: Avoid manual searching
+3. **Follow RFC specifications precisely**
+4. **Update audit tables when adding database fields**
+
+### Before Committing
+
+1. **Run full test suite**: `make test`
+2. **Check linting**: `make lint`
+3. **Test with race detector**: `make test-race`
+
+## Getting Help
+
+### Internal Resources
+
+- Check existing similar implementations in codebase
+- Use LSP tools to understand code relationships
+- Read related test files for expected behavior
+
+### External Resources
+
+- Official RFC specifications for protocol compliance
+- Go documentation for language features
+- PostgreSQL documentation for database issues
+
+### Debug Information Collection
+
+When reporting issues, include:
+
+1. **Exact error message**
+2. **Steps to reproduce**
+3. **Relevant code snippets**
+4. **Test output (if applicable)**
+5. **Environment information** (OS, Go version, etc.)
diff --git a/.claude/docs/WORKFLOWS.md b/.claude/docs/WORKFLOWS.md
new file mode 100644
index 0000000000000..1bd595c8a4b34
--- /dev/null
+++ b/.claude/docs/WORKFLOWS.md
@@ -0,0 +1,192 @@
+# Development Workflows and Guidelines
+
+## Quick Start Checklist for New Features
+
+### Before Starting
+
+- [ ] Run `git pull` to ensure you're on latest code
+- [ ] Check if feature touches database - you'll need migrations
+- [ ] Check if feature touches audit logs - update `enterprise/audit/table.go`
+
+## Development Server
+
+### Starting Development Mode
+
+- **Use `./scripts/develop.sh` to start Coder in development mode**
+- This automatically builds and runs with `--dev` flag and proper access URL
+- **⚠️ Do NOT manually run `make build && ./coder server --dev` - use the script instead**
+
+### Development Workflow
+
+1. **Always start with the development script**: `./scripts/develop.sh`
+2. **Make changes** to your code
+3. **The script will automatically rebuild** and restart as needed
+4. **Access the development server** at the URL provided by the script
+
+## Code Style Guidelines
+
+### Go Style
+
+- Follow [Effective Go](https://go.dev/doc/effective_go) and [Go's Code Review Comments](https://github.com/golang/go/wiki/CodeReviewComments)
+- Create packages when used during implementation
+- Validate abstractions against implementations
+- **Test packages**: Use `package_test` naming (e.g., `identityprovider_test`) for black-box testing
+
+### Error Handling
+
+- Use descriptive error messages
+- Wrap errors with context
+- Propagate errors appropriately
+- Use proper error types
+- Pattern: `xerrors.Errorf("failed to X: %w", err)`
+
+### Naming Conventions
+
+- Use clear, descriptive names
+- Abbreviate only when obvious
+- Follow Go and TypeScript naming conventions
+
+### Comments
+
+- Document exported functions, types, and non-obvious logic
+- Follow JSDoc format for TypeScript
+- Use godoc format for Go code
+
+## Database Migration Workflows
+
+### Migration Guidelines
+
+1. **Create migration files**:
+   - Location: `coderd/database/migrations/`
+   - Format: `{number}_{description}.{up|down}.sql`
+   - Number must be unique and sequential
+   - Always include both up and down migrations
+
+2. **Use helper scripts**:
+   - `./coderd/database/migrations/create_migration.sh "migration name"` - Creates new migration files
+   - `./coderd/database/migrations/fix_migration_numbers.sh` - Renumbers migrations to avoid conflicts
+   - `./coderd/database/migrations/create_fixture.sh "fixture name"` - Creates test fixtures for migrations
+
+3. **Update database queries**:
+   - **MUST DO**: Any changes to database - adding queries, modifying queries should be done in the `coderd/database/queries/*.sql` files
+   - **MUST DO**: Queries are grouped in files relating to context - e.g. `prebuilds.sql`, `users.sql`, `oauth2.sql`
+   - After making changes to any `coderd/database/queries/*.sql` files you must run `make gen` to generate respective ORM changes
+
+4. **Handle nullable fields**:
+   - Use `sql.NullString`, `sql.NullBool`, etc. for optional database fields
+   - Set `.Valid = true` when providing values
+
+5. **Audit table updates**:
+   - If adding fields to auditable types, update `enterprise/audit/table.go`
+   - Add each new field with appropriate action (ActionTrack, ActionIgnore, ActionSecret)
+   - Run `make gen` to verify no audit errors
+
+6. **In-memory database (dbmem) updates**:
+   - When adding new fields to database structs, ensure `dbmem` implementation copies all fields
+   - Check `coderd/database/dbmem/dbmem.go` for Insert/Update methods
+   - Missing fields in dbmem can cause tests to fail even if main implementation is correct
+
+### Database Generation Process
+
+1. Modify SQL files in `coderd/database/queries/`
+2. Run `make gen`
+3. If errors about audit table, update `enterprise/audit/table.go`
+4. Run `make gen` again
+5. Run `make lint` to catch any remaining issues
+
+## API Development Workflow
+
+### Adding New API Endpoints
+
+1. **Define types** in `codersdk/` package
+2. **Add handler** in appropriate `coderd/` file
+3. **Register route** in `coderd/coderd.go`
+4. **Add tests** in `coderd/*_test.go` files
+5. **Update OpenAPI** by running `make gen`
+
+## Testing Workflows
+
+### Test Execution
+
+- Run full test suite: `make test`
+- Run specific test: `make test RUN=TestFunctionName`
+- Run with Postgres: `make test-postgres`
+- Run with race detector: `make test-race`
+- Run end-to-end tests: `make test-e2e`
+
+### Test Development
+
+- Use table-driven tests for comprehensive coverage
+- Mock external dependencies
+- Test both positive and negative cases
+- Use `testutil.WaitLong` for timeouts in tests
+- Always use `t.Parallel()` in tests
+
+## Commit Style
+
+- Follow [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/)
+- Format: `type(scope): message`
+- Types: `feat`, `fix`, `docs`, `style`, `refactor`, `test`, `chore`
+- Keep message titles concise (~70 characters)
+- Use imperative, present tense in commit titles
+
+## Code Navigation and Investigation
+
+### Using Go LSP Tools (STRONGLY RECOMMENDED)
+
+**IMPORTANT**: Always use Go LSP tools for code navigation and understanding. These tools provide accurate, real-time analysis of the codebase and should be your first choice for code investigation.
+
+1. **Find function definitions** (USE THIS FREQUENTLY):
+   - `mcp__go-language-server__definition symbolName`
+   - Example: `mcp__go-language-server__definition getOAuth2ProviderAppAuthorize`
+   - Quickly jump to function implementations across packages
+
+2. **Find symbol references** (ESSENTIAL FOR UNDERSTANDING IMPACT):
+   - `mcp__go-language-server__references symbolName`
+   - Locate all usages of functions, types, or variables
+   - Critical for refactoring and understanding data flow
+
+3. **Get symbol information**:
+   - `mcp__go-language-server__hover filePath line column`
+   - Get type information and documentation at specific positions
+
+### Investigation Strategy (LSP-First Approach)
+
+1. **Start with route registration** in `coderd/coderd.go` to understand API endpoints
+2. **Use LSP `definition` lookup** to trace from route handlers to actual implementations
+3. **Use LSP `references`** to understand how functions are called throughout the codebase
+4. **Follow the middleware chain** using LSP tools to understand request processing flow
+5. **Check test files** for expected behavior and error patterns
+
+## Troubleshooting Development Issues
+
+### Common Issues
+
+1. **Development server won't start** - Use `./scripts/develop.sh` instead of manual commands
+2. **Database migration errors** - Check migration file format and use helper scripts
+3. **Test failures after database changes** - Update `dbmem` implementations
+4. **Audit table errors** - Update `enterprise/audit/table.go` with new fields
+5. **OAuth2 compliance issues** - Ensure RFC-compliant error responses
+
+### Debug Commands
+
+- Check linting: `make lint`
+- Generate code: `make gen`
+- Clean build: `make clean`
+
+## Development Environment Setup
+
+### Prerequisites
+
+- Go (version specified in go.mod)
+- Node.js and pnpm for frontend development
+- PostgreSQL for database testing
+- Docker for containerized testing
+
+### First Time Setup
+
+1. Clone the repository
+2. Run `./scripts/develop.sh` to start development server
+3. Access the development URL provided
+4. Create admin user as prompted
+5. Begin development
diff --git a/.claude/scripts/format.sh b/.claude/scripts/format.sh
new file mode 100755
index 0000000000000..4917de9afca00
--- /dev/null
+++ b/.claude/scripts/format.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+
+# Claude Code hook script for file formatting
+# This script integrates with the centralized Makefile formatting targets
+# and supports the Claude Code hooks system for automatic file formatting.
+
+set -euo pipefail
+
+# Read JSON input from stdin
+input=$(cat)
+
+# Extract the file path from the JSON input
+# Expected format: {"tool_input": {"file_path": "/absolute/path/to/file"}} or {"tool_response": {"filePath": "/absolute/path/to/file"}}
+file_path=$(echo "$input" | jq -r '.tool_input.file_path // .tool_response.filePath // empty')
+
+if [[ -z "$file_path" ]]; then
+	echo "Error: No file path provided in input" >&2
+	exit 1
+fi
+
+# Check if file exists
+if [[ ! -f "$file_path" ]]; then
+	echo "Error: File does not exist: $file_path" >&2
+	exit 1
+fi
+
+# Get the file extension to determine the appropriate formatter
+file_ext="${file_path##*.}"
+
+# Change to the project root directory (where the Makefile is located)
+cd "$(dirname "$0")/../.."
+
+# Call the appropriate Makefile target based on file extension
+case "$file_ext" in
+go)
+	make fmt/go FILE="$file_path"
+	echo "✓ Formatted Go file: $file_path"
+	;;
+js | jsx | ts | tsx)
+	make fmt/ts FILE="$file_path"
+	echo "✓ Formatted TypeScript/JavaScript file: $file_path"
+	;;
+tf | tfvars)
+	make fmt/terraform FILE="$file_path"
+	echo "✓ Formatted Terraform file: $file_path"
+	;;
+sh)
+	make fmt/shfmt FILE="$file_path"
+	echo "✓ Formatted shell script: $file_path"
+	;;
+md)
+	make fmt/markdown FILE="$file_path"
+	echo "✓ Formatted Markdown file: $file_path"
+	;;
+*)
+	echo "No formatter available for file extension: $file_ext"
+	exit 0
+	;;
+esac
diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000000000..a0753e0c11cd6
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,15 @@
+{
+	"hooks": {
+		"PostToolUse": [
+			{
+				"matcher": "Edit|Write|MultiEdit",
+				"hooks": [
+					{
+						"type": "command",
+						"command": ".claude/scripts/format.sh"
+					}
+				]
+			}
+		]
+	}
+}
diff --git a/CLAUDE.md b/CLAUDE.md
index 48cc2fa7aa0cb..4df2514a45863 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,37 +1,25 @@
 # Coder Development Guidelines
 
-Read [cursor rules](.cursorrules).
-
-## Quick Start Checklist for New Features
-
-### Before Starting
-
-- [ ] Run `git pull` to ensure you're on latest code
-- [ ] Check if feature touches database - you'll need migrations
-- [ ] Check if feature touches audit logs - update `enterprise/audit/table.go`
-
-## Development Server
-
-### Starting Development Mode
-
-- Use `./scripts/develop.sh` to start Coder in development mode
-- This automatically builds and runs with `--dev` flag and proper access URL
-- Do NOT manually run `make build && ./coder server --dev` - use the script instead
-
-## Build/Test/Lint Commands
-
-### Main Commands
-
-- `make build` or `make build-fat` - Build all "fat" binaries (includes "server" functionality)
-- `make build-slim` - Build "slim" binaries
-- `make test` - Run Go tests
-- `make test RUN=TestFunctionName` or `go test -v ./path/to/package -run TestFunctionName` - Test single
-- `make test-postgres` - Run tests with Postgres database
-- `make test-race` - Run tests with Go race detector
-- `make test-e2e` - Run end-to-end tests
-- `make lint` - Run all linters
-- `make fmt` - Format all code
-- `make gen` - Generates mocks, database queries and other auto-generated files
+@.claude/docs/WORKFLOWS.md
+@.cursorrules
+@README.md
+@package.json
+
+## 🚀 Essential Commands
+
+| Task              | Command                  | Notes                            |
+|-------------------|--------------------------|----------------------------------|
+| **Development**   | `./scripts/develop.sh`   | ⚠️ Don't use manual build        |
+| **Build**         | `make build`             | Fat binaries (includes server)   |
+| **Build Slim**    | `make build-slim`        | Slim binaries                    |
+| **Test**          | `make test`              | Full test suite                  |
+| **Test Single**   | `make test RUN=TestName` | Faster than full suite           |
+| **Test Postgres** | `make test-postgres`     | Run tests with Postgres database |
+| **Test Race**     | `make test-race`         | Run tests with Go race detector  |
+| **Lint**          | `make lint`              | Always run after changes         |
+| **Generate**      | `make gen`               | After database changes           |
+| **Format**        | `make fmt`               | Auto-format code                 |
+| **Clean**         | `make clean`             | Clean build artifacts            |
 
 ### Frontend Commands (site directory)
 
@@ -42,370 +30,96 @@ Read [cursor rules](.cursorrules).
 - `pnpm lint` - Lint frontend code
 - `pnpm test` - Run frontend tests
 
-## Code Style Guidelines
-
-### Go
-
-- Follow [Effective Go](https://go.dev/doc/effective_go) and [Go's Code Review Comments](https://github.com/golang/go/wiki/CodeReviewComments)
-- Use `gofumpt` for formatting
-- Create packages when used during implementation
-- Validate abstractions against implementations
-- **Test packages**: Use `package_test` naming (e.g., `identityprovider_test`) for black-box testing
-
-### Error Handling
-
-- Use descriptive error messages
-- Wrap errors with context
-- Propagate errors appropriately
-- Use proper error types
-- (`xerrors.Errorf("failed to X: %w", err)`)
-
-### Naming
-
-- Use clear, descriptive names
-- Abbreviate only when obvious
-- Follow Go and TypeScript naming conventions
-
-### Comments
-
-- Document exported functions, types, and non-obvious logic
-- Follow JSDoc format for TypeScript
-- Use godoc format for Go code
-
-## Commit Style
-
-- Follow [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/)
-- Format: `type(scope): message`
-- Types: `feat`, `fix`, `docs`, `style`, `refactor`, `test`, `chore`
-- Keep message titles concise (~70 characters)
-- Use imperative, present tense in commit titles
+### Documentation Commands
 
-## Database Work
+- `pnpm run format-docs` - Format markdown tables in docs
+- `pnpm run lint-docs` - Lint and fix markdown files
+- `pnpm run storybook` - Run Storybook (from site directory)
 
-### Migration Guidelines
+## 🔧 Critical Patterns
 
-1. **Create migration files**:
-   - Location: `coderd/database/migrations/`
-   - Format: `{number}_{description}.{up|down}.sql`
-   - Number must be unique and sequential
-   - Always include both up and down migrations
-   - **Use helper scripts**:
-     - `./coderd/database/migrations/create_migration.sh "migration name"` - Creates new migration files
-     - `./coderd/database/migrations/fix_migration_numbers.sh` - Renumbers migrations to avoid conflicts
-     - `./coderd/database/migrations/create_fixture.sh "fixture name"` - Creates test fixtures for migrations
+### Database Changes (ALWAYS FOLLOW)
 
-2. **Update database queries**:
-   - MUST DO! Any changes to database - adding queries, modifying queries should be done in the `coderd/database/queries/*.sql` files
-   - MUST DO! Queries are grouped in files relating to context - e.g. `prebuilds.sql`, `users.sql`, `oauth2.sql`
-   - After making changes to any `coderd/database/queries/*.sql` files you must run `make gen` to generate respective ORM changes
-
-3. **Handle nullable fields**:
-   - Use `sql.NullString`, `sql.NullBool`, etc. for optional database fields
-   - Set `.Valid = true` when providing values
-   - Example:
-
-     ```go
-     CodeChallenge: sql.NullString{
-         String: params.codeChallenge,
-         Valid:  params.codeChallenge != "",
-     }
-     ```
-
-4. **Audit table updates**:
-   - If adding fields to auditable types, update `enterprise/audit/table.go`
-   - Add each new field with appropriate action (ActionTrack, ActionIgnore, ActionSecret)
-   - Run `make gen` to verify no audit errors
-
-5. **In-memory database (dbmem) updates**:
-   - When adding new fields to database structs, ensure `dbmem` implementation copies all fields
-   - Check `coderd/database/dbmem/dbmem.go` for Insert/Update methods
-   - Missing fields in dbmem can cause tests to fail even if main implementation is correct
-
-### Database Generation Process
-
-1. Modify SQL files in `coderd/database/queries/`
+1. Modify `coderd/database/queries/*.sql` files
 2. Run `make gen`
-3. If errors about audit table, update `enterprise/audit/table.go`
+3. If audit errors: update `enterprise/audit/table.go`
 4. Run `make gen` again
-5. Run `make lint` to catch any remaining issues
+5. Update `coderd/database/dbmem/dbmem.go` in-memory implementations
 
-### In-Memory Database Testing
+### LSP Navigation (USE FIRST)
 
-When adding new database fields:
+- **Find definitions**: `mcp__go-language-server__definition symbolName`
+- **Find references**: `mcp__go-language-server__references symbolName`
+- **Get type info**: `mcp__go-language-server__hover filePath line column`
 
-- **CRITICAL**: Update `coderd/database/dbmem/dbmem.go` in-memory implementations
-- The `Insert*` functions must include ALL new fields, not just basic ones
-- Common issue: Tests pass with real database but fail with in-memory database due to missing field mappings
-- Always verify in-memory database functions match the real database schema after migrations
-
-Example pattern:
+### OAuth2 Error Handling
 
 ```go
-// In dbmem.go - ensure ALL fields are included
-code := database.OAuth2ProviderAppCode{
-    ID:                  arg.ID,
-    CreatedAt:           arg.CreatedAt,
-    // ... existing fields ...
-    ResourceUri:         arg.ResourceUri,         // New field
-    CodeChallenge:       arg.CodeChallenge,       // New field
-    CodeChallengeMethod: arg.CodeChallengeMethod, // New field
-}
+// OAuth2-compliant error responses
+writeOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_grant", "description")
 ```
 
-## Architecture
-
-### Core Components
-
-- **coderd**: Main API service connecting workspaces, provisioners, and users
-- **provisionerd**: Execution context for infrastructure-modifying providers
-- **Agents**: Services in remote workspaces providing features like SSH and port forwarding
-- **Workspaces**: Cloud resources defined by Terraform
-
-### Adding New API Endpoints
-
-1. **Define types** in `codersdk/` package
-2. **Add handler** in appropriate `coderd/` file
-3. **Register route** in `coderd/coderd.go`
-4. **Add tests** in `coderd/*_test.go` files
-5. **Update OpenAPI** by running `make gen`
-
-## Sub-modules
-
-### Template System
-
-- Templates define infrastructure for workspaces using Terraform
-- Environment variables pass context between Coder and templates
-- Official modules extend development environments
-
-### RBAC System
-
-- Permissions defined at site, organization, and user levels
-- Object-Action model protects resources
-- Built-in roles: owner, member, auditor, templateAdmin
-- Permission format: `<sign>?<level>.<object>.<id>.<action>`
-
-### Database
-
-- PostgreSQL 13+ recommended for production
-- Migrations managed with `migrate`
-- Database authorization through `dbauthz` package
-
-## Frontend
-
-The frontend is contained in the site folder.
-
-For building Frontend refer to [this document](docs/about/contributing/frontend.md)
-
-## Common Patterns
-
-### OAuth2/Authentication Work
-
-- Types go in `codersdk/oauth2.go` or similar
-- Handlers go in `coderd/oauth2.go` or `coderd/identityprovider/`
-- Database fields need migration + audit table updates
-- Always support backward compatibility
-
-## OAuth2 Development
-
-### OAuth2 Provider Implementation
-
-When working on OAuth2 provider features:
-
-1. **OAuth2 Spec Compliance**:
-   - Follow RFC 6749 for token responses
-   - Use `expires_in` (seconds) not `expiry` (timestamp) in token responses
-   - Return proper OAuth2 error format: `{"error": "code", "error_description": "details"}`
-
-2. **Error Response Format**:
-   - Create OAuth2-compliant error responses for token endpoint
-   - Use standard error codes: `invalid_client`, `invalid_grant`, `invalid_request`
-   - Avoid generic error responses for OAuth2 endpoints
-
-3. **Testing OAuth2 Features**:
-   - Use scripts in `./scripts/oauth2/` for testing
-   - Run `./scripts/oauth2/test-mcp-oauth2.sh` for comprehensive tests
-   - Manual testing: use `./scripts/oauth2/test-manual-flow.sh`
-
-4. **PKCE Implementation**:
-   - Support both with and without PKCE for backward compatibility
-   - Use S256 method for code challenge
-   - Properly validate code_verifier against stored code_challenge
-
-5. **UI Authorization Flow**:
-   - Use POST requests for consent, not GET with links
-   - Avoid dependency on referer headers for security decisions
-   - Support proper state parameter validation
-
-6. **RFC 8707 Resource Indicators**:
-   - Store resource parameters in database for server-side validation (opaque tokens)
-   - Validate resource consistency between authorization and token requests
-   - Support audience validation in refresh token flows
-   - Resource parameter is optional but must be consistent when provided
-
-### OAuth2 Error Handling Pattern
+### Authorization Context
 
 ```go
-// Define specific OAuth2 errors
-var (
-    errInvalidPKCE = xerrors.New("invalid code_verifier")
-)
-
-// Use OAuth2-compliant error responses
-type OAuth2Error struct {
-    Error            string `json:"error"`
-    ErrorDescription string `json:"error_description,omitempty"`
-}
-
-// Return proper OAuth2 errors
-if errors.Is(err, errInvalidPKCE) {
-    writeOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_grant", "The PKCE code verifier is invalid")
-    return
-}
-```
-
-### Testing Patterns
-
-- Use table-driven tests for comprehensive coverage
-- Mock external dependencies
-- Test both positive and negative cases
-- Use `testutil.WaitLong` for timeouts in tests
-
-## Code Navigation and Investigation
-
-### Using Go LSP Tools (STRONGLY RECOMMENDED)
-
-**IMPORTANT**: Always use Go LSP tools for code navigation and understanding. These tools provide accurate, real-time analysis of the codebase and should be your first choice for code investigation.
-
-When working with the Coder codebase, leverage Go Language Server Protocol tools for efficient code navigation:
-
-1. **Find function definitions** (USE THIS FREQUENTLY):
+// Public endpoints needing system access
+app, err := api.Database.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID)
 
-   ```none
-   mcp__go-language-server__definition symbolName
-   ```
-
-   - Example: `mcp__go-language-server__definition getOAuth2ProviderAppAuthorize`
-   - Example: `mcp__go-language-server__definition ExtractAPIKeyMW`
-   - Quickly jump to function implementations across packages
-   - **Use this when**: You see a function call and want to understand its implementation
-   - **Tip**: Include package prefix if symbol is ambiguous (e.g., `httpmw.ExtractAPIKeyMW`)
-
-2. **Find symbol references** (ESSENTIAL FOR UNDERSTANDING IMPACT):
-
-   ```none
-   mcp__go-language-server__references symbolName
-   ```
-
-   - Example: `mcp__go-language-server__references APITokenFromRequest`
-   - Locate all usages of functions, types, or variables
-   - Understand code dependencies and call patterns
-   - **Use this when**: Making changes to understand what code might be affected
-   - **Critical for**: Refactoring, deprecating functions, or understanding data flow
-
-3. **Get symbol information** (HELPFUL FOR TYPE INFO):
-
-   ```none
-   mcp__go-language-server__hover filePath line column
-   ```
-
-   - Example: `mcp__go-language-server__hover /Users/thomask33/Projects/coder/coderd/httpmw/apikey.go 560 25`
-   - Get type information and documentation at specific positions
-   - **Use this when**: You need to understand the type of a variable or return value
-
-4. **Edit files using LSP** (WHEN MAKING TARGETED CHANGES):
-
-   ```none
-   mcp__go-language-server__edit_file filePath edits
-   ```
-
-   - Make precise edits using line numbers
-   - **Use this when**: You need to make small, targeted changes to specific lines
-
-5. **Get diagnostics** (ALWAYS CHECK AFTER CHANGES):
-
-   ```none
-   mcp__go-language-server__diagnostics filePath
-   ```
-
-   - Check for compilation errors, unused imports, etc.
-   - **Use this when**: After making changes to ensure code is still valid
-
-### LSP Tool Usage Priority
-
-**ALWAYS USE THESE TOOLS FIRST**:
-
-- **Use LSP `definition`** instead of manual searching for function implementations
-- **Use LSP `references`** instead of grep when looking for function/type usage
-- **Use LSP `hover`** to understand types and signatures
-- **Use LSP `diagnostics`** after making changes to check for errors
+// Authenticated endpoints with user context
+app, err := api.Database.GetOAuth2ProviderAppByClientID(ctx, clientID)
+```
 
-**When to use other tools**:
+## 📋 Quick Reference
 
-- **Use Grep for**: Text-based searches, finding patterns across files, searching comments
-- **Use Bash for**: Running tests, git commands, build operations
-- **Use Read tool for**: Reading configuration files, documentation, non-Go files
+### Full workflows available in imported WORKFLOWS.md
 
-### Investigation Strategy (LSP-First Approach)
+### New Feature Checklist
 
-1. **Start with route registration** in `coderd/coderd.go` to understand API endpoints
-2. **Use LSP `definition` lookup** to trace from route handlers to actual implementations
-3. **Use LSP `references`** to understand how functions are called throughout the codebase
-4. **Follow the middleware chain** using LSP tools to understand request processing flow
-5. **Check test files** for expected behavior and error patterns
-6. **Use LSP `diagnostics`** to ensure your changes don't break compilation
+- [ ] Run `git pull` to ensure latest code
+- [ ] Check if feature touches database - you'll need migrations
+- [ ] Check if feature touches audit logs - update `enterprise/audit/table.go`
 
-### Common LSP Workflows
+## 🏗️ Architecture
 
-**Understanding a new feature**:
+- **coderd**: Main API service
+- **provisionerd**: Infrastructure provisioning
+- **Agents**: Workspace services (SSH, port forwarding)
+- **Database**: PostgreSQL with `dbauthz` authorization
 
-1. Use `grep` to find the main entry point (e.g., route registration)
-2. Use LSP `definition` to jump to handler implementation
-3. Use LSP `references` to see how the handler is used
-4. Use LSP `definition` on each function call within the handler
+## 🧪 Testing
 
-**Making changes to existing code**:
+### Race Condition Prevention
 
-1. Use LSP `references` to understand the impact of your changes
-2. Use LSP `definition` to understand the current implementation
-3. Make your changes using `Edit` or LSP `edit_file`
-4. Use LSP `diagnostics` to verify your changes compile correctly
-5. Run tests to ensure functionality still works
+- Use unique identifiers: `fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano())`
+- Never use hardcoded names in concurrent tests
 
-**Debugging issues**:
+### OAuth2 Testing
 
-1. Use LSP `definition` to find the problematic function
-2. Use LSP `references` to trace how the function is called
-3. Use LSP `hover` to understand parameter types and return values
-4. Use `Read` to examine the full context around the issue
+- Full suite: `./scripts/oauth2/test-mcp-oauth2.sh`
+- Manual testing: `./scripts/oauth2/test-manual-flow.sh`
 
-## Testing Scripts
+## 🎯 Code Style
 
-### OAuth2 Test Scripts
+### Detailed guidelines in imported WORKFLOWS.md
 
-Located in `./scripts/oauth2/`:
+- Follow [Uber Go Style Guide](https://github.com/uber-go/guide/blob/master/style.md)
+- Commit format: `type(scope): message`
 
-- `test-mcp-oauth2.sh` - Full automated test suite
-- `setup-test-app.sh` - Create test OAuth2 app
-- `cleanup-test-app.sh` - Remove test app
-- `generate-pkce.sh` - Generate PKCE parameters
-- `test-manual-flow.sh` - Manual browser testing
+## 📚 Detailed Development Guides
 
-Always run the full test suite after OAuth2 changes:
+@.claude/docs/OAUTH2.md
+@.claude/docs/TESTING.md
+@.claude/docs/TROUBLESHOOTING.md
+@.claude/docs/DATABASE.md
 
-```bash
-./scripts/oauth2/test-mcp-oauth2.sh
-```
+## 🚨 Common Pitfalls
 
-## Troubleshooting
+1. **Audit table errors** → Update `enterprise/audit/table.go`
+2. **OAuth2 errors** → Return RFC-compliant format
+3. **dbmem failures** → Update in-memory implementations
+4. **Race conditions** → Use unique test identifiers
+5. **Missing newlines** → Ensure files end with newline
 
-### Common Issues
+---
 
-1. **"Audit table entry missing action"** - Update `enterprise/audit/table.go`
-2. **"package should be X_test"** - Use `package_test` naming for test files
-3. **SQL type errors** - Use `sql.Null*` types for nullable fields
-4. **Missing newlines** - Ensure files end with newline character
-5. **Tests passing locally but failing in CI** - Check if `dbmem` implementation needs updating
-6. **OAuth2 endpoints returning wrong error format** - Ensure OAuth2 endpoints return RFC 6749 compliant errors
-7. **OAuth2 tests failing but scripts working** - Check in-memory database implementations in `dbmem.go`
-8. **Resource indicator validation failing** - Ensure database stores and retrieves resource parameters correctly
-9. **PKCE tests failing** - Verify both authorization code storage and token exchange handle PKCE fields
+*This file stays lean and actionable. Detailed workflows and explanations are imported automatically.*
diff --git a/Makefile b/Makefile
index b6e69ac28f223..0ed464ba23a80 100644
--- a/Makefile
+++ b/Makefile
@@ -456,16 +456,31 @@ fmt: fmt/ts fmt/go fmt/terraform fmt/shfmt fmt/biome fmt/markdown
 .PHONY: fmt
 
 fmt/go:
+ifdef FILE
+	# Format single file
+	if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.go ]] && ! grep -q "DO NOT EDIT" "$(FILE)"; then \
+		echo "$(GREEN)==>$(RESET) $(BOLD)fmt/go$(RESET) $(FILE)"; \
+		go run mvdan.cc/gofumpt@v0.8.0 -w -l "$(FILE)"; \
+	fi
+else
 	go mod tidy
 	echo "$(GREEN)==>$(RESET) $(BOLD)fmt/go$(RESET)"
 	# VS Code users should check out
 	# https://github.com/mvdan/gofumpt#visual-studio-code
 	find . $(FIND_EXCLUSIONS) -type f -name '*.go' -print0 | \
-		xargs -0 grep --null -L "DO NOT EDIT" | \
-		xargs -0 go run mvdan.cc/gofumpt@v0.4.0 -w -l
+		xargs -0 grep -E --null -L '^// Code generated .* DO NOT EDIT\.$$' | \
+		xargs -0 go run mvdan.cc/gofumpt@v0.8.0 -w -l
+endif
 .PHONY: fmt/go
 
 fmt/ts: site/node_modules/.installed
+ifdef FILE
+	# Format single TypeScript/JavaScript file
+	if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.ts ]] || [[ "$(FILE)" == *.tsx ]] || [[ "$(FILE)" == *.js ]] || [[ "$(FILE)" == *.jsx ]]; then \
+		echo "$(GREEN)==>$(RESET) $(BOLD)fmt/ts$(RESET) $(FILE)"; \
+		(cd site/ && pnpm exec biome format --write "../$(FILE)"); \
+	fi
+else
 	echo "$(GREEN)==>$(RESET) $(BOLD)fmt/ts$(RESET)"
 	cd site
 # Avoid writing files in CI to reduce file write activity
@@ -474,9 +489,17 @@ ifdef CI
 else
 	pnpm run check:fix
 endif
+endif
 .PHONY: fmt/ts
 
 fmt/biome: site/node_modules/.installed
+ifdef FILE
+	# Format single file with biome
+	if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.ts ]] || [[ "$(FILE)" == *.tsx ]] || [[ "$(FILE)" == *.js ]] || [[ "$(FILE)" == *.jsx ]]; then \
+		echo "$(GREEN)==>$(RESET) $(BOLD)fmt/biome$(RESET) $(FILE)"; \
+		(cd site/ && pnpm exec biome format --write "../$(FILE)"); \
+	fi
+else
 	echo "$(GREEN)==>$(RESET) $(BOLD)fmt/biome$(RESET)"
 	cd site/
 # Avoid writing files in CI to reduce file write activity
@@ -485,14 +508,30 @@ ifdef CI
 else
 	pnpm run format
 endif
+endif
 .PHONY: fmt/biome
 
 fmt/terraform: $(wildcard *.tf)
+ifdef FILE
+	# Format single Terraform file
+	if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.tf ]] || [[ "$(FILE)" == *.tfvars ]]; then \
+		echo "$(GREEN)==>$(RESET) $(BOLD)fmt/terraform$(RESET) $(FILE)"; \
+		terraform fmt "$(FILE)"; \
+	fi
+else
 	echo "$(GREEN)==>$(RESET) $(BOLD)fmt/terraform$(RESET)"
 	terraform fmt -recursive
+endif
 .PHONY: fmt/terraform
 
 fmt/shfmt: $(SHELL_SRC_FILES)
+ifdef FILE
+	# Format single shell script
+	if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.sh ]]; then \
+		echo "$(GREEN)==>$(RESET) $(BOLD)fmt/shfmt$(RESET) $(FILE)"; \
+		shfmt -w "$(FILE)"; \
+	fi
+else
 	echo "$(GREEN)==>$(RESET) $(BOLD)fmt/shfmt$(RESET)"
 # Only do diff check in CI, errors on diff.
 ifdef CI
@@ -500,11 +539,20 @@ ifdef CI
 else
 	shfmt -w $(SHELL_SRC_FILES)
 endif
+endif
 .PHONY: fmt/shfmt
 
 fmt/markdown: node_modules/.installed
+ifdef FILE
+	# Format single markdown file
+	if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.md ]]; then \
+		echo "$(GREEN)==>$(RESET) $(BOLD)fmt/markdown$(RESET) $(FILE)"; \
+		pnpm exec markdown-table-formatter "$(FILE)"; \
+	fi
+else
 	echo "$(GREEN)==>$(RESET) $(BOLD)fmt/markdown$(RESET)"
 	pnpm format-docs
+endif
 .PHONY: fmt/markdown
 
 lint: lint/shellcheck lint/go lint/ts lint/examples lint/helm lint/site-icons lint/markdown
diff --git a/agent/agentcontainers/dcspec/gen.sh b/agent/agentcontainers/dcspec/gen.sh
index 276cb24cb4123..056fd218fd247 100755
--- a/agent/agentcontainers/dcspec/gen.sh
+++ b/agent/agentcontainers/dcspec/gen.sh
@@ -61,7 +61,7 @@ fi
 exec 3>&-
 
 # Format the generated code.
-go run mvdan.cc/gofumpt@v0.4.0 -w -l "${TMPDIR}/${DEST_FILENAME}"
+go run mvdan.cc/gofumpt@v0.8.0 -w -l "${TMPDIR}/${DEST_FILENAME}"
 
 # Add a header so that Go recognizes this as a generated file.
 if grep -q -- "\[-i extension\]" < <(sed -h 2>&1); then
diff --git a/archive/fs/zip.go b/archive/fs/zip.go
new file mode 100644
index 0000000000000..81f72d18bdf46
--- /dev/null
+++ b/archive/fs/zip.go
@@ -0,0 +1,19 @@
+package archivefs
+
+import (
+	"archive/zip"
+	"io"
+	"io/fs"
+
+	"github.com/spf13/afero"
+	"github.com/spf13/afero/zipfs"
+)
+
+// FromZipReader creates a read-only in-memory FS
+func FromZipReader(r io.ReaderAt, size int64) (fs.FS, error) {
+	zr, err := zip.NewReader(r, size)
+	if err != nil {
+		return nil, err
+	}
+	return afero.NewIOFS(zipfs.New(zr)), nil
+}
diff --git a/cli/configssh.go b/cli/configssh.go
index c1be60b604a9e..b12b9d5c3d5cd 100644
--- a/cli/configssh.go
+++ b/cli/configssh.go
@@ -446,7 +446,7 @@ func (r *RootCmd) configSSH() *serpent.Command {
 
 			if !bytes.Equal(configRaw, configModified) {
 				sshDir := filepath.Dir(sshConfigFile)
-				if err := os.MkdirAll(sshDir, 0700); err != nil {
+				if err := os.MkdirAll(sshDir, 0o700); err != nil {
 					return xerrors.Errorf("failed to create directory %q: %w", sshDir, err)
 				}
 
diff --git a/cli/configssh_test.go b/cli/configssh_test.go
index 1ffe93a7b838c..7e42bfe81a799 100644
--- a/cli/configssh_test.go
+++ b/cli/configssh_test.go
@@ -204,10 +204,11 @@ func TestConfigSSH_MissingDirectory(t *testing.T) {
 	_, err = os.Stat(sshConfigPath)
 	require.NoError(t, err, "config file should exist")
 
-	// Check that the directory has proper permissions (0700)
+	// Check that the directory has proper permissions (rwx for owner, none for
+	// group and everyone)
 	sshDirInfo, err := os.Stat(sshDir)
 	require.NoError(t, err)
-	require.Equal(t, os.FileMode(0700), sshDirInfo.Mode().Perm(), "directory should have 0700 permissions")
+	require.Equal(t, os.FileMode(0o700), sshDirInfo.Mode().Perm(), "directory should have rwx------ permissions")
 }
 
 func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
@@ -358,7 +359,8 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
 					strings.Join([]string{
 						headerEnd,
 						"",
-					}, "\n")},
+					}, "\n"),
+				},
 			},
 			args: []string{"--ssh-option", "ForwardAgent=yes"},
 			matches: []match{
@@ -383,7 +385,8 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
 					strings.Join([]string{
 						headerEnd,
 						"",
-					}, "\n")},
+					}, "\n"),
+				},
 			},
 			args: []string{"--ssh-option", "ForwardAgent=yes"},
 			matches: []match{
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 57f5d1640e182..e102b6f22fd4a 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -2324,6 +2324,132 @@ const docTemplate = `{
                 }
             }
         },
+        "/oauth2/clients/{client_id}": {
+            "get": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Enterprise"
+                ],
+                "summary": "Get OAuth2 client configuration (RFC 7592)",
+                "operationId": "get-oauth2-client-configuration",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Client ID",
+                        "name": "client_id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.OAuth2ClientConfiguration"
+                        }
+                    }
+                }
+            },
+            "put": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Enterprise"
+                ],
+                "summary": "Update OAuth2 client configuration (RFC 7592)",
+                "operationId": "put-oauth2-client-configuration",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Client ID",
+                        "name": "client_id",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "description": "Client update request",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.OAuth2ClientRegistrationRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.OAuth2ClientConfiguration"
+                        }
+                    }
+                }
+            },
+            "delete": {
+                "tags": [
+                    "Enterprise"
+                ],
+                "summary": "Delete OAuth2 client registration (RFC 7592)",
+                "operationId": "delete-oauth2-client-configuration",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Client ID",
+                        "name": "client_id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "204": {
+                        "description": "No Content"
+                    }
+                }
+            }
+        },
+        "/oauth2/register": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Enterprise"
+                ],
+                "summary": "OAuth2 dynamic client registration (RFC 7591)",
+                "operationId": "oauth2-dynamic-client-registration",
+                "parameters": [
+                    {
+                        "description": "Client registration request",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.OAuth2ClientRegistrationRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "201": {
+                        "description": "Created",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.OAuth2ClientRegistrationResponse"
+                        }
+                    }
+                }
+            }
+        },
         "/oauth2/tokens": {
             "post": {
                 "produces": [
@@ -11585,7 +11711,73 @@ const docTemplate = `{
             }
         },
         "codersdk.CreateTestAuditLogRequest": {
-            "type": "object"
+            "type": "object",
+            "properties": {
+                "action": {
+                    "enum": [
+                        "create",
+                        "write",
+                        "delete",
+                        "start",
+                        "stop"
+                    ],
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.AuditAction"
+                        }
+                    ]
+                },
+                "additional_fields": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                },
+                "build_reason": {
+                    "enum": [
+                        "autostart",
+                        "autostop",
+                        "initiator"
+                    ],
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.BuildReason"
+                        }
+                    ]
+                },
+                "organization_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "request_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "resource_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "resource_type": {
+                    "enum": [
+                        "template",
+                        "template_version",
+                        "user",
+                        "workspace",
+                        "workspace_build",
+                        "git_ssh_key",
+                        "auditable_group"
+                    ],
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.ResourceType"
+                        }
+                    ]
+                },
+                "time": {
+                    "type": "string",
+                    "format": "date-time"
+                }
+            }
         },
         "codersdk.CreateTokenRequest": {
             "type": "object",
@@ -12358,12 +12550,16 @@ const docTemplate = `{
                 "auto-fill-parameters",
                 "notifications",
                 "workspace-usage",
-                "web-push"
+                "web-push",
+                "oauth2",
+                "mcp-server-http"
             ],
             "x-enum-comments": {
                 "ExperimentAutoFillParameters": "This should not be taken out of experiments until we have redesigned the feature.",
                 "ExperimentExample": "This isn't used for anything.",
+                "ExperimentMCPServerHTTP": "Enables the MCP HTTP server functionality.",
                 "ExperimentNotifications": "Sends notifications via SMTP and webhooks following certain events.",
+                "ExperimentOAuth2": "Enables OAuth2 provider functionality.",
                 "ExperimentWebPush": "Enables web push notifications through the browser.",
                 "ExperimentWorkspaceUsage": "Enables the new workspace usage tracking."
             },
@@ -12372,7 +12568,9 @@ const docTemplate = `{
                 "ExperimentAutoFillParameters",
                 "ExperimentNotifications",
                 "ExperimentWorkspaceUsage",
-                "ExperimentWebPush"
+                "ExperimentWebPush",
+                "ExperimentOAuth2",
+                "ExperimentMCPServerHTTP"
             ]
         },
         "codersdk.ExternalAuth": {
@@ -13424,6 +13622,228 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.OAuth2ClientConfiguration": {
+            "type": "object",
+            "properties": {
+                "client_id": {
+                    "type": "string"
+                },
+                "client_id_issued_at": {
+                    "type": "integer"
+                },
+                "client_name": {
+                    "type": "string"
+                },
+                "client_secret_expires_at": {
+                    "type": "integer"
+                },
+                "client_uri": {
+                    "type": "string"
+                },
+                "contacts": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "grant_types": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "jwks": {
+                    "type": "object"
+                },
+                "jwks_uri": {
+                    "type": "string"
+                },
+                "logo_uri": {
+                    "type": "string"
+                },
+                "policy_uri": {
+                    "type": "string"
+                },
+                "redirect_uris": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "registration_access_token": {
+                    "type": "string"
+                },
+                "registration_client_uri": {
+                    "type": "string"
+                },
+                "response_types": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "scope": {
+                    "type": "string"
+                },
+                "software_id": {
+                    "type": "string"
+                },
+                "software_version": {
+                    "type": "string"
+                },
+                "token_endpoint_auth_method": {
+                    "type": "string"
+                },
+                "tos_uri": {
+                    "type": "string"
+                }
+            }
+        },
+        "codersdk.OAuth2ClientRegistrationRequest": {
+            "type": "object",
+            "properties": {
+                "client_name": {
+                    "type": "string"
+                },
+                "client_uri": {
+                    "type": "string"
+                },
+                "contacts": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "grant_types": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "jwks": {
+                    "type": "object"
+                },
+                "jwks_uri": {
+                    "type": "string"
+                },
+                "logo_uri": {
+                    "type": "string"
+                },
+                "policy_uri": {
+                    "type": "string"
+                },
+                "redirect_uris": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "response_types": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "scope": {
+                    "type": "string"
+                },
+                "software_id": {
+                    "type": "string"
+                },
+                "software_statement": {
+                    "type": "string"
+                },
+                "software_version": {
+                    "type": "string"
+                },
+                "token_endpoint_auth_method": {
+                    "type": "string"
+                },
+                "tos_uri": {
+                    "type": "string"
+                }
+            }
+        },
+        "codersdk.OAuth2ClientRegistrationResponse": {
+            "type": "object",
+            "properties": {
+                "client_id": {
+                    "type": "string"
+                },
+                "client_id_issued_at": {
+                    "type": "integer"
+                },
+                "client_name": {
+                    "type": "string"
+                },
+                "client_secret": {
+                    "type": "string"
+                },
+                "client_secret_expires_at": {
+                    "type": "integer"
+                },
+                "client_uri": {
+                    "type": "string"
+                },
+                "contacts": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "grant_types": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "jwks": {
+                    "type": "object"
+                },
+                "jwks_uri": {
+                    "type": "string"
+                },
+                "logo_uri": {
+                    "type": "string"
+                },
+                "policy_uri": {
+                    "type": "string"
+                },
+                "redirect_uris": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "registration_access_token": {
+                    "type": "string"
+                },
+                "registration_client_uri": {
+                    "type": "string"
+                },
+                "response_types": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "scope": {
+                    "type": "string"
+                },
+                "software_id": {
+                    "type": "string"
+                },
+                "software_version": {
+                    "type": "string"
+                },
+                "token_endpoint_auth_method": {
+                    "type": "string"
+                },
+                "tos_uri": {
+                    "type": "string"
+                }
+            }
+        },
         "codersdk.OAuth2Config": {
             "type": "object",
             "properties": {
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index e5c6d1025f20c..95a08f2f53c9b 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -2034,6 +2034,112 @@
 				}
 			}
 		},
+		"/oauth2/clients/{client_id}": {
+			"get": {
+				"consumes": ["application/json"],
+				"produces": ["application/json"],
+				"tags": ["Enterprise"],
+				"summary": "Get OAuth2 client configuration (RFC 7592)",
+				"operationId": "get-oauth2-client-configuration",
+				"parameters": [
+					{
+						"type": "string",
+						"description": "Client ID",
+						"name": "client_id",
+						"in": "path",
+						"required": true
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "OK",
+						"schema": {
+							"$ref": "#/definitions/codersdk.OAuth2ClientConfiguration"
+						}
+					}
+				}
+			},
+			"put": {
+				"consumes": ["application/json"],
+				"produces": ["application/json"],
+				"tags": ["Enterprise"],
+				"summary": "Update OAuth2 client configuration (RFC 7592)",
+				"operationId": "put-oauth2-client-configuration",
+				"parameters": [
+					{
+						"type": "string",
+						"description": "Client ID",
+						"name": "client_id",
+						"in": "path",
+						"required": true
+					},
+					{
+						"description": "Client update request",
+						"name": "request",
+						"in": "body",
+						"required": true,
+						"schema": {
+							"$ref": "#/definitions/codersdk.OAuth2ClientRegistrationRequest"
+						}
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "OK",
+						"schema": {
+							"$ref": "#/definitions/codersdk.OAuth2ClientConfiguration"
+						}
+					}
+				}
+			},
+			"delete": {
+				"tags": ["Enterprise"],
+				"summary": "Delete OAuth2 client registration (RFC 7592)",
+				"operationId": "delete-oauth2-client-configuration",
+				"parameters": [
+					{
+						"type": "string",
+						"description": "Client ID",
+						"name": "client_id",
+						"in": "path",
+						"required": true
+					}
+				],
+				"responses": {
+					"204": {
+						"description": "No Content"
+					}
+				}
+			}
+		},
+		"/oauth2/register": {
+			"post": {
+				"consumes": ["application/json"],
+				"produces": ["application/json"],
+				"tags": ["Enterprise"],
+				"summary": "OAuth2 dynamic client registration (RFC 7591)",
+				"operationId": "oauth2-dynamic-client-registration",
+				"parameters": [
+					{
+						"description": "Client registration request",
+						"name": "request",
+						"in": "body",
+						"required": true,
+						"schema": {
+							"$ref": "#/definitions/codersdk.OAuth2ClientRegistrationRequest"
+						}
+					}
+				],
+				"responses": {
+					"201": {
+						"description": "Created",
+						"schema": {
+							"$ref": "#/definitions/codersdk.OAuth2ClientRegistrationResponse"
+						}
+					}
+				}
+			}
+		},
 		"/oauth2/tokens": {
 			"post": {
 				"produces": ["application/json"],
@@ -10321,7 +10427,63 @@
 			}
 		},
 		"codersdk.CreateTestAuditLogRequest": {
-			"type": "object"
+			"type": "object",
+			"properties": {
+				"action": {
+					"enum": ["create", "write", "delete", "start", "stop"],
+					"allOf": [
+						{
+							"$ref": "#/definitions/codersdk.AuditAction"
+						}
+					]
+				},
+				"additional_fields": {
+					"type": "array",
+					"items": {
+						"type": "integer"
+					}
+				},
+				"build_reason": {
+					"enum": ["autostart", "autostop", "initiator"],
+					"allOf": [
+						{
+							"$ref": "#/definitions/codersdk.BuildReason"
+						}
+					]
+				},
+				"organization_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"request_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"resource_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"resource_type": {
+					"enum": [
+						"template",
+						"template_version",
+						"user",
+						"workspace",
+						"workspace_build",
+						"git_ssh_key",
+						"auditable_group"
+					],
+					"allOf": [
+						{
+							"$ref": "#/definitions/codersdk.ResourceType"
+						}
+					]
+				},
+				"time": {
+					"type": "string",
+					"format": "date-time"
+				}
+			}
 		},
 		"codersdk.CreateTokenRequest": {
 			"type": "object",
@@ -11069,12 +11231,16 @@
 				"auto-fill-parameters",
 				"notifications",
 				"workspace-usage",
-				"web-push"
+				"web-push",
+				"oauth2",
+				"mcp-server-http"
 			],
 			"x-enum-comments": {
 				"ExperimentAutoFillParameters": "This should not be taken out of experiments until we have redesigned the feature.",
 				"ExperimentExample": "This isn't used for anything.",
+				"ExperimentMCPServerHTTP": "Enables the MCP HTTP server functionality.",
 				"ExperimentNotifications": "Sends notifications via SMTP and webhooks following certain events.",
+				"ExperimentOAuth2": "Enables OAuth2 provider functionality.",
 				"ExperimentWebPush": "Enables web push notifications through the browser.",
 				"ExperimentWorkspaceUsage": "Enables the new workspace usage tracking."
 			},
@@ -11083,7 +11249,9 @@
 				"ExperimentAutoFillParameters",
 				"ExperimentNotifications",
 				"ExperimentWorkspaceUsage",
-				"ExperimentWebPush"
+				"ExperimentWebPush",
+				"ExperimentOAuth2",
+				"ExperimentMCPServerHTTP"
 			]
 		},
 		"codersdk.ExternalAuth": {
@@ -12086,6 +12254,228 @@
 				}
 			}
 		},
+		"codersdk.OAuth2ClientConfiguration": {
+			"type": "object",
+			"properties": {
+				"client_id": {
+					"type": "string"
+				},
+				"client_id_issued_at": {
+					"type": "integer"
+				},
+				"client_name": {
+					"type": "string"
+				},
+				"client_secret_expires_at": {
+					"type": "integer"
+				},
+				"client_uri": {
+					"type": "string"
+				},
+				"contacts": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"grant_types": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"jwks": {
+					"type": "object"
+				},
+				"jwks_uri": {
+					"type": "string"
+				},
+				"logo_uri": {
+					"type": "string"
+				},
+				"policy_uri": {
+					"type": "string"
+				},
+				"redirect_uris": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"registration_access_token": {
+					"type": "string"
+				},
+				"registration_client_uri": {
+					"type": "string"
+				},
+				"response_types": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"scope": {
+					"type": "string"
+				},
+				"software_id": {
+					"type": "string"
+				},
+				"software_version": {
+					"type": "string"
+				},
+				"token_endpoint_auth_method": {
+					"type": "string"
+				},
+				"tos_uri": {
+					"type": "string"
+				}
+			}
+		},
+		"codersdk.OAuth2ClientRegistrationRequest": {
+			"type": "object",
+			"properties": {
+				"client_name": {
+					"type": "string"
+				},
+				"client_uri": {
+					"type": "string"
+				},
+				"contacts": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"grant_types": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"jwks": {
+					"type": "object"
+				},
+				"jwks_uri": {
+					"type": "string"
+				},
+				"logo_uri": {
+					"type": "string"
+				},
+				"policy_uri": {
+					"type": "string"
+				},
+				"redirect_uris": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"response_types": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"scope": {
+					"type": "string"
+				},
+				"software_id": {
+					"type": "string"
+				},
+				"software_statement": {
+					"type": "string"
+				},
+				"software_version": {
+					"type": "string"
+				},
+				"token_endpoint_auth_method": {
+					"type": "string"
+				},
+				"tos_uri": {
+					"type": "string"
+				}
+			}
+		},
+		"codersdk.OAuth2ClientRegistrationResponse": {
+			"type": "object",
+			"properties": {
+				"client_id": {
+					"type": "string"
+				},
+				"client_id_issued_at": {
+					"type": "integer"
+				},
+				"client_name": {
+					"type": "string"
+				},
+				"client_secret": {
+					"type": "string"
+				},
+				"client_secret_expires_at": {
+					"type": "integer"
+				},
+				"client_uri": {
+					"type": "string"
+				},
+				"contacts": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"grant_types": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"jwks": {
+					"type": "object"
+				},
+				"jwks_uri": {
+					"type": "string"
+				},
+				"logo_uri": {
+					"type": "string"
+				},
+				"policy_uri": {
+					"type": "string"
+				},
+				"redirect_uris": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"registration_access_token": {
+					"type": "string"
+				},
+				"registration_client_uri": {
+					"type": "string"
+				},
+				"response_types": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
+				"scope": {
+					"type": "string"
+				},
+				"software_id": {
+					"type": "string"
+				},
+				"software_version": {
+					"type": "string"
+				},
+				"token_endpoint_auth_method": {
+					"type": "string"
+				},
+				"tos_uri": {
+					"type": "string"
+				}
+			}
+		},
 		"codersdk.OAuth2Config": {
 			"type": "object",
 			"properties": {
diff --git a/coderd/coderd.go b/coderd/coderd.go
index 07c345135a5eb..72316d1ea18e5 100644
--- a/coderd/coderd.go
+++ b/coderd/coderd.go
@@ -19,6 +19,7 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/coder/coder/v2/coderd/oauth2provider"
 	"github.com/coder/coder/v2/coderd/prebuilds"
 
 	"github.com/andybalholm/brotli"
@@ -913,16 +914,16 @@ func New(options *Options) *API {
 	}
 
 	// OAuth2 metadata endpoint for RFC 8414 discovery
-	r.Get("/.well-known/oauth-authorization-server", api.oauth2AuthorizationServerMetadata)
+	r.Get("/.well-known/oauth-authorization-server", api.oauth2AuthorizationServerMetadata())
 	// OAuth2 protected resource metadata endpoint for RFC 9728 discovery
-	r.Get("/.well-known/oauth-protected-resource", api.oauth2ProtectedResourceMetadata)
+	r.Get("/.well-known/oauth-protected-resource", api.oauth2ProtectedResourceMetadata())
 
 	// OAuth2 linking routes do not make sense under the /api/v2 path.  These are
 	// for an external application to use Coder as an OAuth2 provider, not for
 	// logging into Coder with an external OAuth2 provider.
 	r.Route("/oauth2", func(r chi.Router) {
 		r.Use(
-			api.oAuth2ProviderMiddleware,
+			httpmw.RequireExperimentWithDevBypass(api.Experiments, codersdk.ExperimentOAuth2),
 		)
 		r.Route("/authorize", func(r chi.Router) {
 			r.Use(
@@ -950,6 +951,20 @@ func New(options *Options) *API {
 			// we cannot require an API key.
 			r.Post("/", api.postOAuth2ProviderAppToken())
 		})
+
+		// RFC 7591 Dynamic Client Registration - Public endpoint
+		r.Post("/register", api.postOAuth2ClientRegistration())
+
+		// RFC 7592 Client Configuration Management - Protected by registration access token
+		r.Route("/clients/{client_id}", func(r chi.Router) {
+			r.Use(
+				// Middleware to validate registration access token
+				oauth2provider.RequireRegistrationAccessToken(api.Database),
+			)
+			r.Get("/", api.oauth2ClientConfiguration())          // Read client configuration
+			r.Put("/", api.putOAuth2ClientConfiguration())       // Update client configuration
+			r.Delete("/", api.deleteOAuth2ClientConfiguration()) // Delete client
+		})
 	})
 
 	// Experimental routes are not guaranteed to be stable and may change at any time.
@@ -958,6 +973,13 @@ func New(options *Options) *API {
 		r.Route("/aitasks", func(r chi.Router) {
 			r.Get("/prompts", api.aiTasksPrompts)
 		})
+		r.Route("/mcp", func(r chi.Router) {
+			r.Use(
+				httpmw.RequireExperimentWithDevBypass(api.Experiments, codersdk.ExperimentOAuth2, codersdk.ExperimentMCPServerHTTP),
+			)
+			// MCP HTTP transport endpoint with mandatory authentication
+			r.Mount("/http", api.mcpHTTPHandler())
+		})
 	})
 
 	r.Route("/api/v2", func(r chi.Router) {
@@ -1455,25 +1477,25 @@ func New(options *Options) *API {
 		r.Route("/oauth2-provider", func(r chi.Router) {
 			r.Use(
 				apiKeyMiddleware,
-				api.oAuth2ProviderMiddleware,
+				httpmw.RequireExperimentWithDevBypass(api.Experiments, codersdk.ExperimentOAuth2),
 			)
 			r.Route("/apps", func(r chi.Router) {
-				r.Get("/", api.oAuth2ProviderApps)
-				r.Post("/", api.postOAuth2ProviderApp)
+				r.Get("/", api.oAuth2ProviderApps())
+				r.Post("/", api.postOAuth2ProviderApp())
 
 				r.Route("/{app}", func(r chi.Router) {
 					r.Use(httpmw.ExtractOAuth2ProviderApp(options.Database))
-					r.Get("/", api.oAuth2ProviderApp)
-					r.Put("/", api.putOAuth2ProviderApp)
-					r.Delete("/", api.deleteOAuth2ProviderApp)
+					r.Get("/", api.oAuth2ProviderApp())
+					r.Put("/", api.putOAuth2ProviderApp())
+					r.Delete("/", api.deleteOAuth2ProviderApp())
 
 					r.Route("/secrets", func(r chi.Router) {
-						r.Get("/", api.oAuth2ProviderAppSecrets)
-						r.Post("/", api.postOAuth2ProviderAppSecret)
+						r.Get("/", api.oAuth2ProviderAppSecrets())
+						r.Post("/", api.postOAuth2ProviderAppSecret())
 
 						r.Route("/{secretID}", func(r chi.Router) {
 							r.Use(httpmw.ExtractOAuth2ProviderAppSecret(options.Database))
-							r.Delete("/", api.deleteOAuth2ProviderAppSecret)
+							r.Delete("/", api.deleteOAuth2ProviderAppSecret())
 						})
 					})
 				})
diff --git a/coderd/coderdtest/dynamicparameters.go b/coderd/coderdtest/dynamicparameters.go
index fbc61b745d2a3..5d03f9fde9639 100644
--- a/coderd/coderdtest/dynamicparameters.go
+++ b/coderd/coderdtest/dynamicparameters.go
@@ -25,6 +25,8 @@ type DynamicParameterTemplateParams struct {
 
 	// TemplateID is used to update an existing template instead of creating a new one.
 	TemplateID uuid.UUID
+
+	Version func(request *codersdk.CreateTemplateVersionRequest)
 }
 
 func DynamicParameterTemplate(t *testing.T, client *codersdk.Client, org uuid.UUID, args DynamicParameterTemplateParams) (codersdk.Template, codersdk.TemplateVersion) {
@@ -47,6 +49,9 @@ func DynamicParameterTemplate(t *testing.T, client *codersdk.Client, org uuid.UU
 		if args.TemplateID != uuid.Nil {
 			request.TemplateID = args.TemplateID
 		}
+		if args.Version != nil {
+			args.Version(request)
+		}
 	})
 	AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 65630849084b1..eea1b04a51fc5 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -397,6 +397,8 @@ var (
 					rbac.ResourceCryptoKey.Type:              {policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},
 					rbac.ResourceFile.Type:                   {policy.ActionCreate, policy.ActionRead},
 					rbac.ResourceProvisionerJobs.Type:        {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
+					rbac.ResourceOauth2App.Type:              {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
+					rbac.ResourceOauth2AppSecret.Type:        {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
 				}),
 				Org:  map[string][]rbac.Permission{},
 				User: []rbac.Permission{},
@@ -1448,6 +1450,13 @@ func (q *querier) DeleteLicense(ctx context.Context, id int32) (int32, error) {
 	return id, nil
 }
 
+func (q *querier) DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error {
+	if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceOauth2App); err != nil {
+		return err
+	}
+	return q.db.DeleteOAuth2ProviderAppByClientID(ctx, id)
+}
+
 func (q *querier) DeleteOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) error {
 	if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceOauth2App); err != nil {
 		return err
@@ -2148,6 +2157,13 @@ func (q *querier) GetOAuth2GithubDefaultEligible(ctx context.Context) (bool, err
 	return q.db.GetOAuth2GithubDefaultEligible(ctx)
 }
 
+func (q *querier) GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2App); err != nil {
+		return database.OAuth2ProviderApp{}, err
+	}
+	return q.db.GetOAuth2ProviderAppByClientID(ctx, id)
+}
+
 func (q *querier) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) {
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2App); err != nil {
 		return database.OAuth2ProviderApp{}, err
@@ -2155,6 +2171,13 @@ func (q *querier) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (d
 	return q.db.GetOAuth2ProviderAppByID(ctx, id)
 }
 
+func (q *querier) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (database.OAuth2ProviderApp, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2App); err != nil {
+		return database.OAuth2ProviderApp{}, err
+	}
+	return q.db.GetOAuth2ProviderAppByRegistrationToken(ctx, registrationAccessToken)
+}
+
 func (q *querier) GetOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderAppCode, error) {
 	return fetch(q.log, q.auth, q.db.GetOAuth2ProviderAppCodeByID)(ctx, id)
 }
@@ -4317,6 +4340,13 @@ func (q *querier) UpdateNotificationTemplateMethodByID(ctx context.Context, arg
 	return q.db.UpdateNotificationTemplateMethodByID(ctx, arg)
 }
 
+func (q *querier) UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByClientIDParams) (database.OAuth2ProviderApp, error) {
+	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceOauth2App); err != nil {
+		return database.OAuth2ProviderApp{}, err
+	}
+	return q.db.UpdateOAuth2ProviderAppByClientID(ctx, arg)
+}
+
 func (q *querier) UpdateOAuth2ProviderAppByID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByIDParams) (database.OAuth2ProviderApp, error) {
 	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceOauth2App); err != nil {
 		return database.OAuth2ProviderApp{}, err
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index c94a049ed188f..006320ef459a4 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -5182,17 +5182,15 @@ func (s *MethodTestSuite) TestOAuth2ProviderApps() {
 		key, _ := dbgen.APIKey(s.T(), db, database.APIKey{
 			UserID: user.ID,
 		})
-		createdAt := dbtestutil.NowInDefaultTimezone()
-		if !dbtestutil.WillUsePostgres() {
-			createdAt = time.Time{}
-		}
+		// Use a fixed timestamp for consistent test results across all database types
+		fixedTime := time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC)
 		app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{
-			CreatedAt: createdAt,
-			UpdatedAt: createdAt,
+			CreatedAt: fixedTime,
+			UpdatedAt: fixedTime,
 		})
 		_ = dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{
-			CreatedAt: createdAt,
-			UpdatedAt: createdAt,
+			CreatedAt: fixedTime,
+			UpdatedAt: fixedTime,
 		})
 		secret := dbgen.OAuth2ProviderAppSecret(s.T(), db, database.OAuth2ProviderAppSecret{
 			AppID: app.ID,
@@ -5206,6 +5204,8 @@ func (s *MethodTestSuite) TestOAuth2ProviderApps() {
 			})
 		}
 		expectedApp := app
+		expectedApp.CreatedAt = fixedTime
+		expectedApp.UpdatedAt = fixedTime
 		check.Args(user.ID).Asserts(rbac.ResourceOauth2AppCodeToken.WithOwner(user.ID.String()), policy.ActionRead).Returns([]database.GetOAuth2ProviderAppsByUserIDRow{
 			{
 				OAuth2ProviderApp: expectedApp,
@@ -5222,20 +5222,77 @@ func (s *MethodTestSuite) TestOAuth2ProviderApps() {
 		app.Name = "my-new-name"
 		app.UpdatedAt = dbtestutil.NowInDefaultTimezone()
 		check.Args(database.UpdateOAuth2ProviderAppByIDParams{
-			ID:                    app.ID,
-			Name:                  app.Name,
-			Icon:                  app.Icon,
-			CallbackURL:           app.CallbackURL,
-			RedirectUris:          app.RedirectUris,
-			ClientType:            app.ClientType,
-			DynamicallyRegistered: app.DynamicallyRegistered,
-			UpdatedAt:             app.UpdatedAt,
+			ID:                      app.ID,
+			Name:                    app.Name,
+			Icon:                    app.Icon,
+			CallbackURL:             app.CallbackURL,
+			RedirectUris:            app.RedirectUris,
+			ClientType:              app.ClientType,
+			DynamicallyRegistered:   app.DynamicallyRegistered,
+			ClientSecretExpiresAt:   app.ClientSecretExpiresAt,
+			GrantTypes:              app.GrantTypes,
+			ResponseTypes:           app.ResponseTypes,
+			TokenEndpointAuthMethod: app.TokenEndpointAuthMethod,
+			Scope:                   app.Scope,
+			Contacts:                app.Contacts,
+			ClientUri:               app.ClientUri,
+			LogoUri:                 app.LogoUri,
+			TosUri:                  app.TosUri,
+			PolicyUri:               app.PolicyUri,
+			JwksUri:                 app.JwksUri,
+			Jwks:                    app.Jwks,
+			SoftwareID:              app.SoftwareID,
+			SoftwareVersion:         app.SoftwareVersion,
+			UpdatedAt:               app.UpdatedAt,
 		}).Asserts(rbac.ResourceOauth2App, policy.ActionUpdate).Returns(app)
 	}))
 	s.Run("DeleteOAuth2ProviderAppByID", s.Subtest(func(db database.Store, check *expects) {
 		app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
 		check.Args(app.ID).Asserts(rbac.ResourceOauth2App, policy.ActionDelete)
 	}))
+	s.Run("GetOAuth2ProviderAppByClientID", s.Subtest(func(db database.Store, check *expects) {
+		app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
+		check.Args(app.ID).Asserts(rbac.ResourceOauth2App, policy.ActionRead).Returns(app)
+	}))
+	s.Run("DeleteOAuth2ProviderAppByClientID", s.Subtest(func(db database.Store, check *expects) {
+		app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
+		check.Args(app.ID).Asserts(rbac.ResourceOauth2App, policy.ActionDelete)
+	}))
+	s.Run("UpdateOAuth2ProviderAppByClientID", s.Subtest(func(db database.Store, check *expects) {
+		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
+		app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
+		app.Name = "updated-name"
+		app.UpdatedAt = dbtestutil.NowInDefaultTimezone()
+		check.Args(database.UpdateOAuth2ProviderAppByClientIDParams{
+			ID:                      app.ID,
+			Name:                    app.Name,
+			Icon:                    app.Icon,
+			CallbackURL:             app.CallbackURL,
+			RedirectUris:            app.RedirectUris,
+			ClientType:              app.ClientType,
+			ClientSecretExpiresAt:   app.ClientSecretExpiresAt,
+			GrantTypes:              app.GrantTypes,
+			ResponseTypes:           app.ResponseTypes,
+			TokenEndpointAuthMethod: app.TokenEndpointAuthMethod,
+			Scope:                   app.Scope,
+			Contacts:                app.Contacts,
+			ClientUri:               app.ClientUri,
+			LogoUri:                 app.LogoUri,
+			TosUri:                  app.TosUri,
+			PolicyUri:               app.PolicyUri,
+			JwksUri:                 app.JwksUri,
+			Jwks:                    app.Jwks,
+			SoftwareID:              app.SoftwareID,
+			SoftwareVersion:         app.SoftwareVersion,
+			UpdatedAt:               app.UpdatedAt,
+		}).Asserts(rbac.ResourceOauth2App, policy.ActionUpdate).Returns(app)
+	}))
+	s.Run("GetOAuth2ProviderAppByRegistrationToken", s.Subtest(func(db database.Store, check *expects) {
+		app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{
+			RegistrationAccessToken: sql.NullString{String: "test-token", Valid: true},
+		})
+		check.Args(sql.NullString{String: "test-token", Valid: true}).Asserts(rbac.ResourceOauth2App, policy.ActionRead).Returns(app)
+	}))
 }
 
 func (s *MethodTestSuite) TestOAuth2ProviderAppSecrets() {
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
index cb42a2d38904f..0bb7bde403297 100644
--- a/coderd/database/dbgen/dbgen.go
+++ b/coderd/database/dbgen/dbgen.go
@@ -1132,21 +1132,32 @@ func WorkspaceAgentStat(t testing.TB, db database.Store, orig database.Workspace
 
 func OAuth2ProviderApp(t testing.TB, db database.Store, seed database.OAuth2ProviderApp) database.OAuth2ProviderApp {
 	app, err := db.InsertOAuth2ProviderApp(genCtx, database.InsertOAuth2ProviderAppParams{
-		ID:           takeFirst(seed.ID, uuid.New()),
-		Name:         takeFirst(seed.Name, testutil.GetRandomName(t)),
-		CreatedAt:    takeFirst(seed.CreatedAt, dbtime.Now()),
-		UpdatedAt:    takeFirst(seed.UpdatedAt, dbtime.Now()),
-		Icon:         takeFirst(seed.Icon, ""),
-		CallbackURL:  takeFirst(seed.CallbackURL, "http://localhost"),
-		RedirectUris: takeFirstSlice(seed.RedirectUris, []string{}),
-		ClientType: takeFirst(seed.ClientType, sql.NullString{
-			String: "confidential",
-			Valid:  true,
-		}),
-		DynamicallyRegistered: takeFirst(seed.DynamicallyRegistered, sql.NullBool{
-			Bool:  false,
-			Valid: true,
-		}),
+		ID:                      takeFirst(seed.ID, uuid.New()),
+		Name:                    takeFirst(seed.Name, testutil.GetRandomName(t)),
+		CreatedAt:               takeFirst(seed.CreatedAt, dbtime.Now()),
+		UpdatedAt:               takeFirst(seed.UpdatedAt, dbtime.Now()),
+		Icon:                    takeFirst(seed.Icon, ""),
+		CallbackURL:             takeFirst(seed.CallbackURL, "http://localhost"),
+		RedirectUris:            takeFirstSlice(seed.RedirectUris, []string{}),
+		ClientType:              takeFirst(seed.ClientType, sql.NullString{String: "confidential", Valid: true}),
+		DynamicallyRegistered:   takeFirst(seed.DynamicallyRegistered, sql.NullBool{Bool: false, Valid: true}),
+		ClientIDIssuedAt:        takeFirst(seed.ClientIDIssuedAt, sql.NullTime{}),
+		ClientSecretExpiresAt:   takeFirst(seed.ClientSecretExpiresAt, sql.NullTime{}),
+		GrantTypes:              takeFirstSlice(seed.GrantTypes, []string{"authorization_code", "refresh_token"}),
+		ResponseTypes:           takeFirstSlice(seed.ResponseTypes, []string{"code"}),
+		TokenEndpointAuthMethod: takeFirst(seed.TokenEndpointAuthMethod, sql.NullString{String: "client_secret_basic", Valid: true}),
+		Scope:                   takeFirst(seed.Scope, sql.NullString{}),
+		Contacts:                takeFirstSlice(seed.Contacts, []string{}),
+		ClientUri:               takeFirst(seed.ClientUri, sql.NullString{}),
+		LogoUri:                 takeFirst(seed.LogoUri, sql.NullString{}),
+		TosUri:                  takeFirst(seed.TosUri, sql.NullString{}),
+		PolicyUri:               takeFirst(seed.PolicyUri, sql.NullString{}),
+		JwksUri:                 takeFirst(seed.JwksUri, sql.NullString{}),
+		Jwks:                    seed.Jwks, // pqtype.NullRawMessage{} is not comparable, use existing value
+		SoftwareID:              takeFirst(seed.SoftwareID, sql.NullString{}),
+		SoftwareVersion:         takeFirst(seed.SoftwareVersion, sql.NullString{}),
+		RegistrationAccessToken: takeFirst(seed.RegistrationAccessToken, sql.NullString{}),
+		RegistrationClientUri:   takeFirst(seed.RegistrationClientUri, sql.NullString{}),
 	})
 	require.NoError(t, err, "insert oauth2 app")
 	return app
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
index 1c65abd29eb7f..d106e6a5858fb 100644
--- a/coderd/database/dbmem/dbmem.go
+++ b/coderd/database/dbmem/dbmem.go
@@ -2044,6 +2044,38 @@ func (q *FakeQuerier) DeleteLicense(_ context.Context, id int32) (int32, error)
 	return 0, sql.ErrNoRows
 }
 
+func (q *FakeQuerier) DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, app := range q.oauth2ProviderApps {
+		if app.ID == id {
+			q.oauth2ProviderApps = append(q.oauth2ProviderApps[:i], q.oauth2ProviderApps[i+1:]...)
+
+			// Also delete related secrets and tokens
+			for j := len(q.oauth2ProviderAppSecrets) - 1; j >= 0; j-- {
+				if q.oauth2ProviderAppSecrets[j].AppID == id {
+					q.oauth2ProviderAppSecrets = append(q.oauth2ProviderAppSecrets[:j], q.oauth2ProviderAppSecrets[j+1:]...)
+				}
+			}
+
+			// Delete tokens for the app's secrets
+			for j := len(q.oauth2ProviderAppTokens) - 1; j >= 0; j-- {
+				token := q.oauth2ProviderAppTokens[j]
+				for _, secret := range q.oauth2ProviderAppSecrets {
+					if secret.AppID == id && token.AppSecretID == secret.ID {
+						q.oauth2ProviderAppTokens = append(q.oauth2ProviderAppTokens[:j], q.oauth2ProviderAppTokens[j+1:]...)
+						break
+					}
+				}
+			}
+
+			return nil
+		}
+	}
+	return sql.ErrNoRows
+}
+
 func (q *FakeQuerier) DeleteOAuth2ProviderAppByID(_ context.Context, id uuid.UUID) error {
 	q.mutex.Lock()
 	defer q.mutex.Unlock()
@@ -3967,6 +3999,18 @@ func (q *FakeQuerier) GetOAuth2GithubDefaultEligible(_ context.Context) (bool, e
 	return *q.oauth2GithubDefaultEligible, nil
 }
 
+func (q *FakeQuerier) GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, app := range q.oauth2ProviderApps {
+		if app.ID == id {
+			return app, nil
+		}
+	}
+	return database.OAuth2ProviderApp{}, sql.ErrNoRows
+}
+
 func (q *FakeQuerier) GetOAuth2ProviderAppByID(_ context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) {
 	q.mutex.Lock()
 	defer q.mutex.Unlock()
@@ -3979,6 +4023,19 @@ func (q *FakeQuerier) GetOAuth2ProviderAppByID(_ context.Context, id uuid.UUID)
 	return database.OAuth2ProviderApp{}, sql.ErrNoRows
 }
 
+func (q *FakeQuerier) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (database.OAuth2ProviderApp, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, app := range q.data.oauth2ProviderApps {
+		if app.RegistrationAccessToken.Valid && registrationAccessToken.Valid &&
+			app.RegistrationAccessToken.String == registrationAccessToken.String {
+			return app, nil
+		}
+	}
+	return database.OAuth2ProviderApp{}, sql.ErrNoRows
+}
+
 func (q *FakeQuerier) GetOAuth2ProviderAppCodeByID(_ context.Context, id uuid.UUID) (database.OAuth2ProviderAppCode, error) {
 	q.mutex.Lock()
 	defer q.mutex.Unlock()
@@ -8926,23 +8983,57 @@ func (q *FakeQuerier) InsertOAuth2ProviderApp(_ context.Context, arg database.In
 	q.mutex.Lock()
 	defer q.mutex.Unlock()
 
-	for _, app := range q.oauth2ProviderApps {
-		if app.Name == arg.Name {
-			return database.OAuth2ProviderApp{}, errUniqueConstraint
-		}
-	}
-
 	//nolint:gosimple // Go wants database.OAuth2ProviderApp(arg), but we cannot be sure the structs will remain identical.
 	app := database.OAuth2ProviderApp{
-		ID:                    arg.ID,
-		CreatedAt:             arg.CreatedAt,
-		UpdatedAt:             arg.UpdatedAt,
-		Name:                  arg.Name,
-		Icon:                  arg.Icon,
-		CallbackURL:           arg.CallbackURL,
-		RedirectUris:          arg.RedirectUris,
-		ClientType:            arg.ClientType,
-		DynamicallyRegistered: arg.DynamicallyRegistered,
+		ID:                      arg.ID,
+		CreatedAt:               arg.CreatedAt,
+		UpdatedAt:               arg.UpdatedAt,
+		Name:                    arg.Name,
+		Icon:                    arg.Icon,
+		CallbackURL:             arg.CallbackURL,
+		RedirectUris:            arg.RedirectUris,
+		ClientType:              arg.ClientType,
+		DynamicallyRegistered:   arg.DynamicallyRegistered,
+		ClientIDIssuedAt:        arg.ClientIDIssuedAt,
+		ClientSecretExpiresAt:   arg.ClientSecretExpiresAt,
+		GrantTypes:              arg.GrantTypes,
+		ResponseTypes:           arg.ResponseTypes,
+		TokenEndpointAuthMethod: arg.TokenEndpointAuthMethod,
+		Scope:                   arg.Scope,
+		Contacts:                arg.Contacts,
+		ClientUri:               arg.ClientUri,
+		LogoUri:                 arg.LogoUri,
+		TosUri:                  arg.TosUri,
+		PolicyUri:               arg.PolicyUri,
+		JwksUri:                 arg.JwksUri,
+		Jwks:                    arg.Jwks,
+		SoftwareID:              arg.SoftwareID,
+		SoftwareVersion:         arg.SoftwareVersion,
+		RegistrationAccessToken: arg.RegistrationAccessToken,
+		RegistrationClientUri:   arg.RegistrationClientUri,
+	}
+
+	// Apply RFC-compliant defaults to match database migration defaults
+	if !app.ClientType.Valid {
+		app.ClientType = sql.NullString{String: "confidential", Valid: true}
+	}
+	if !app.DynamicallyRegistered.Valid {
+		app.DynamicallyRegistered = sql.NullBool{Bool: false, Valid: true}
+	}
+	if len(app.GrantTypes) == 0 {
+		app.GrantTypes = []string{"authorization_code", "refresh_token"}
+	}
+	if len(app.ResponseTypes) == 0 {
+		app.ResponseTypes = []string{"code"}
+	}
+	if !app.TokenEndpointAuthMethod.Valid {
+		app.TokenEndpointAuthMethod = sql.NullString{String: "client_secret_basic", Valid: true}
+	}
+	if !app.Scope.Valid {
+		app.Scope = sql.NullString{String: "", Valid: true}
+	}
+	if app.Contacts == nil {
+		app.Contacts = []string{}
 	}
 	q.oauth2ProviderApps = append(q.oauth2ProviderApps, app)
 
@@ -10793,6 +10884,66 @@ func (*FakeQuerier) UpdateNotificationTemplateMethodByID(_ context.Context, _ da
 	return database.NotificationTemplate{}, ErrUnimplemented
 }
 
+func (q *FakeQuerier) UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByClientIDParams) (database.OAuth2ProviderApp, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return database.OAuth2ProviderApp{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, app := range q.oauth2ProviderApps {
+		if app.ID == arg.ID {
+			app.UpdatedAt = arg.UpdatedAt
+			app.Name = arg.Name
+			app.Icon = arg.Icon
+			app.CallbackURL = arg.CallbackURL
+			app.RedirectUris = arg.RedirectUris
+			app.GrantTypes = arg.GrantTypes
+			app.ResponseTypes = arg.ResponseTypes
+			app.TokenEndpointAuthMethod = arg.TokenEndpointAuthMethod
+			app.Scope = arg.Scope
+			app.Contacts = arg.Contacts
+			app.ClientUri = arg.ClientUri
+			app.LogoUri = arg.LogoUri
+			app.TosUri = arg.TosUri
+			app.PolicyUri = arg.PolicyUri
+			app.JwksUri = arg.JwksUri
+			app.Jwks = arg.Jwks
+			app.SoftwareID = arg.SoftwareID
+			app.SoftwareVersion = arg.SoftwareVersion
+
+			// Apply RFC-compliant defaults to match database migration defaults
+			if !app.ClientType.Valid {
+				app.ClientType = sql.NullString{String: "confidential", Valid: true}
+			}
+			if !app.DynamicallyRegistered.Valid {
+				app.DynamicallyRegistered = sql.NullBool{Bool: false, Valid: true}
+			}
+			if len(app.GrantTypes) == 0 {
+				app.GrantTypes = []string{"authorization_code", "refresh_token"}
+			}
+			if len(app.ResponseTypes) == 0 {
+				app.ResponseTypes = []string{"code"}
+			}
+			if !app.TokenEndpointAuthMethod.Valid {
+				app.TokenEndpointAuthMethod = sql.NullString{String: "client_secret_basic", Valid: true}
+			}
+			if !app.Scope.Valid {
+				app.Scope = sql.NullString{String: "", Valid: true}
+			}
+			if app.Contacts == nil {
+				app.Contacts = []string{}
+			}
+
+			q.oauth2ProviderApps[i] = app
+			return app, nil
+		}
+	}
+	return database.OAuth2ProviderApp{}, sql.ErrNoRows
+}
+
 func (q *FakeQuerier) UpdateOAuth2ProviderAppByID(_ context.Context, arg database.UpdateOAuth2ProviderAppByIDParams) (database.OAuth2ProviderApp, error) {
 	err := validateDatabaseType(arg)
 	if err != nil {
@@ -10810,19 +10961,53 @@ func (q *FakeQuerier) UpdateOAuth2ProviderAppByID(_ context.Context, arg databas
 
 	for index, app := range q.oauth2ProviderApps {
 		if app.ID == arg.ID {
-			newApp := database.OAuth2ProviderApp{
-				ID:                    arg.ID,
-				CreatedAt:             app.CreatedAt,
-				UpdatedAt:             arg.UpdatedAt,
-				Name:                  arg.Name,
-				Icon:                  arg.Icon,
-				CallbackURL:           arg.CallbackURL,
-				RedirectUris:          arg.RedirectUris,
-				ClientType:            arg.ClientType,
-				DynamicallyRegistered: arg.DynamicallyRegistered,
-			}
-			q.oauth2ProviderApps[index] = newApp
-			return newApp, nil
+			app.UpdatedAt = arg.UpdatedAt
+			app.Name = arg.Name
+			app.Icon = arg.Icon
+			app.CallbackURL = arg.CallbackURL
+			app.RedirectUris = arg.RedirectUris
+			app.ClientType = arg.ClientType
+			app.DynamicallyRegistered = arg.DynamicallyRegistered
+			app.ClientSecretExpiresAt = arg.ClientSecretExpiresAt
+			app.GrantTypes = arg.GrantTypes
+			app.ResponseTypes = arg.ResponseTypes
+			app.TokenEndpointAuthMethod = arg.TokenEndpointAuthMethod
+			app.Scope = arg.Scope
+			app.Contacts = arg.Contacts
+			app.ClientUri = arg.ClientUri
+			app.LogoUri = arg.LogoUri
+			app.TosUri = arg.TosUri
+			app.PolicyUri = arg.PolicyUri
+			app.JwksUri = arg.JwksUri
+			app.Jwks = arg.Jwks
+			app.SoftwareID = arg.SoftwareID
+			app.SoftwareVersion = arg.SoftwareVersion
+
+			// Apply RFC-compliant defaults to match database migration defaults
+			if !app.ClientType.Valid {
+				app.ClientType = sql.NullString{String: "confidential", Valid: true}
+			}
+			if !app.DynamicallyRegistered.Valid {
+				app.DynamicallyRegistered = sql.NullBool{Bool: false, Valid: true}
+			}
+			if len(app.GrantTypes) == 0 {
+				app.GrantTypes = []string{"authorization_code", "refresh_token"}
+			}
+			if len(app.ResponseTypes) == 0 {
+				app.ResponseTypes = []string{"code"}
+			}
+			if !app.TokenEndpointAuthMethod.Valid {
+				app.TokenEndpointAuthMethod = sql.NullString{String: "client_secret_basic", Valid: true}
+			}
+			if !app.Scope.Valid {
+				app.Scope = sql.NullString{String: "", Valid: true}
+			}
+			if app.Contacts == nil {
+				app.Contacts = []string{}
+			}
+
+			q.oauth2ProviderApps[index] = app
+			return app, nil
 		}
 	}
 	return database.OAuth2ProviderApp{}, sql.ErrNoRows
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 6c633fe8c5c2f..debb8c2b89f56 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -1,10 +1,11 @@
-// Code generated by coderd/database/gen/metrics.
+// Code generated by scripts/dbgen.
 // Any function can be edited and will not be overwritten.
 // New database functions are automatically generated!
 package dbmetrics
 
 import (
 	"context"
+	"database/sql"
 	"slices"
 	"time"
 
@@ -312,6 +313,13 @@ func (m queryMetricsStore) DeleteLicense(ctx context.Context, id int32) (int32,
 	return licenseID, err
 }
 
+func (m queryMetricsStore) DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error {
+	start := time.Now()
+	r0 := m.s.DeleteOAuth2ProviderAppByClientID(ctx, id)
+	m.queryLatencies.WithLabelValues("DeleteOAuth2ProviderAppByClientID").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m queryMetricsStore) DeleteOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) error {
 	start := time.Now()
 	r0 := m.s.DeleteOAuth2ProviderAppByID(ctx, id)
@@ -977,6 +985,13 @@ func (m queryMetricsStore) GetOAuth2GithubDefaultEligible(ctx context.Context) (
 	return r0, r1
 }
 
+func (m queryMetricsStore) GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetOAuth2ProviderAppByClientID(ctx, id)
+	m.queryLatencies.WithLabelValues("GetOAuth2ProviderAppByClientID").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) {
 	start := time.Now()
 	r0, r1 := m.s.GetOAuth2ProviderAppByID(ctx, id)
@@ -984,6 +999,13 @@ func (m queryMetricsStore) GetOAuth2ProviderAppByID(ctx context.Context, id uuid
 	return r0, r1
 }
 
+func (m queryMetricsStore) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (database.OAuth2ProviderApp, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetOAuth2ProviderAppByRegistrationToken(ctx, registrationAccessToken)
+	m.queryLatencies.WithLabelValues("GetOAuth2ProviderAppByRegistrationToken").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) GetOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderAppCode, error) {
 	start := time.Now()
 	r0, r1 := m.s.GetOAuth2ProviderAppCodeByID(ctx, id)
@@ -2678,6 +2700,13 @@ func (m queryMetricsStore) UpdateNotificationTemplateMethodByID(ctx context.Cont
 	return r0, r1
 }
 
+func (m queryMetricsStore) UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByClientIDParams) (database.OAuth2ProviderApp, error) {
+	start := time.Now()
+	r0, r1 := m.s.UpdateOAuth2ProviderAppByClientID(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateOAuth2ProviderAppByClientID").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) UpdateOAuth2ProviderAppByID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByIDParams) (database.OAuth2ProviderApp, error) {
 	start := time.Now()
 	r0, r1 := m.s.UpdateOAuth2ProviderAppByID(ctx, arg)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 368cb021ab7ca..059f37f8852b9 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -11,6 +11,7 @@ package dbmock
 
 import (
 	context "context"
+	sql "database/sql"
 	reflect "reflect"
 	time "time"
 
@@ -520,6 +521,20 @@ func (mr *MockStoreMockRecorder) DeleteLicense(ctx, id any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteLicense", reflect.TypeOf((*MockStore)(nil).DeleteLicense), ctx, id)
 }
 
+// DeleteOAuth2ProviderAppByClientID mocks base method.
+func (m *MockStore) DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteOAuth2ProviderAppByClientID", ctx, id)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteOAuth2ProviderAppByClientID indicates an expected call of DeleteOAuth2ProviderAppByClientID.
+func (mr *MockStoreMockRecorder) DeleteOAuth2ProviderAppByClientID(ctx, id any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOAuth2ProviderAppByClientID", reflect.TypeOf((*MockStore)(nil).DeleteOAuth2ProviderAppByClientID), ctx, id)
+}
+
 // DeleteOAuth2ProviderAppByID mocks base method.
 func (m *MockStore) DeleteOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) error {
 	m.ctrl.T.Helper()
@@ -2013,6 +2028,21 @@ func (mr *MockStoreMockRecorder) GetOAuth2GithubDefaultEligible(ctx any) *gomock
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOAuth2GithubDefaultEligible", reflect.TypeOf((*MockStore)(nil).GetOAuth2GithubDefaultEligible), ctx)
 }
 
+// GetOAuth2ProviderAppByClientID mocks base method.
+func (m *MockStore) GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetOAuth2ProviderAppByClientID", ctx, id)
+	ret0, _ := ret[0].(database.OAuth2ProviderApp)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetOAuth2ProviderAppByClientID indicates an expected call of GetOAuth2ProviderAppByClientID.
+func (mr *MockStoreMockRecorder) GetOAuth2ProviderAppByClientID(ctx, id any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOAuth2ProviderAppByClientID", reflect.TypeOf((*MockStore)(nil).GetOAuth2ProviderAppByClientID), ctx, id)
+}
+
 // GetOAuth2ProviderAppByID mocks base method.
 func (m *MockStore) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) {
 	m.ctrl.T.Helper()
@@ -2028,6 +2058,21 @@ func (mr *MockStoreMockRecorder) GetOAuth2ProviderAppByID(ctx, id any) *gomock.C
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOAuth2ProviderAppByID", reflect.TypeOf((*MockStore)(nil).GetOAuth2ProviderAppByID), ctx, id)
 }
 
+// GetOAuth2ProviderAppByRegistrationToken mocks base method.
+func (m *MockStore) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (database.OAuth2ProviderApp, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetOAuth2ProviderAppByRegistrationToken", ctx, registrationAccessToken)
+	ret0, _ := ret[0].(database.OAuth2ProviderApp)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetOAuth2ProviderAppByRegistrationToken indicates an expected call of GetOAuth2ProviderAppByRegistrationToken.
+func (mr *MockStoreMockRecorder) GetOAuth2ProviderAppByRegistrationToken(ctx, registrationAccessToken any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOAuth2ProviderAppByRegistrationToken", reflect.TypeOf((*MockStore)(nil).GetOAuth2ProviderAppByRegistrationToken), ctx, registrationAccessToken)
+}
+
 // GetOAuth2ProviderAppCodeByID mocks base method.
 func (m *MockStore) GetOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderAppCode, error) {
 	m.ctrl.T.Helper()
@@ -5708,6 +5753,21 @@ func (mr *MockStoreMockRecorder) UpdateNotificationTemplateMethodByID(ctx, arg a
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateNotificationTemplateMethodByID", reflect.TypeOf((*MockStore)(nil).UpdateNotificationTemplateMethodByID), ctx, arg)
 }
 
+// UpdateOAuth2ProviderAppByClientID mocks base method.
+func (m *MockStore) UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByClientIDParams) (database.OAuth2ProviderApp, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpdateOAuth2ProviderAppByClientID", ctx, arg)
+	ret0, _ := ret[0].(database.OAuth2ProviderApp)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UpdateOAuth2ProviderAppByClientID indicates an expected call of UpdateOAuth2ProviderAppByClientID.
+func (mr *MockStoreMockRecorder) UpdateOAuth2ProviderAppByClientID(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateOAuth2ProviderAppByClientID", reflect.TypeOf((*MockStore)(nil).UpdateOAuth2ProviderAppByClientID), ctx, arg)
+}
+
 // UpdateOAuth2ProviderAppByID mocks base method.
 func (m *MockStore) UpdateOAuth2ProviderAppByID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByIDParams) (database.OAuth2ProviderApp, error) {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index 1f3a142006fd7..54f984294fa4e 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -1158,7 +1158,24 @@ CREATE TABLE oauth2_provider_apps (
     callback_url text NOT NULL,
     redirect_uris text[],
     client_type text DEFAULT 'confidential'::text,
-    dynamically_registered boolean DEFAULT false
+    dynamically_registered boolean DEFAULT false,
+    client_id_issued_at timestamp with time zone DEFAULT now(),
+    client_secret_expires_at timestamp with time zone,
+    grant_types text[] DEFAULT '{authorization_code,refresh_token}'::text[],
+    response_types text[] DEFAULT '{code}'::text[],
+    token_endpoint_auth_method text DEFAULT 'client_secret_basic'::text,
+    scope text DEFAULT ''::text,
+    contacts text[],
+    client_uri text,
+    logo_uri text,
+    tos_uri text,
+    policy_uri text,
+    jwks_uri text,
+    jwks jsonb,
+    software_id text,
+    software_version text,
+    registration_access_token text,
+    registration_client_uri text
 );
 
 COMMENT ON TABLE oauth2_provider_apps IS 'A table used to configure apps that can use Coder as an OAuth2 provider, the reverse of what we are calling external authentication.';
@@ -1169,6 +1186,40 @@ COMMENT ON COLUMN oauth2_provider_apps.client_type IS 'OAuth2 client type: confi
 
 COMMENT ON COLUMN oauth2_provider_apps.dynamically_registered IS 'Whether this app was created via dynamic client registration';
 
+COMMENT ON COLUMN oauth2_provider_apps.client_id_issued_at IS 'RFC 7591: Timestamp when client_id was issued';
+
+COMMENT ON COLUMN oauth2_provider_apps.client_secret_expires_at IS 'RFC 7591: Timestamp when client_secret expires (null for non-expiring)';
+
+COMMENT ON COLUMN oauth2_provider_apps.grant_types IS 'RFC 7591: Array of grant types the client is allowed to use';
+
+COMMENT ON COLUMN oauth2_provider_apps.response_types IS 'RFC 7591: Array of response types the client supports';
+
+COMMENT ON COLUMN oauth2_provider_apps.token_endpoint_auth_method IS 'RFC 7591: Authentication method for token endpoint';
+
+COMMENT ON COLUMN oauth2_provider_apps.scope IS 'RFC 7591: Space-delimited scope values the client can request';
+
+COMMENT ON COLUMN oauth2_provider_apps.contacts IS 'RFC 7591: Array of email addresses for responsible parties';
+
+COMMENT ON COLUMN oauth2_provider_apps.client_uri IS 'RFC 7591: URL of the client home page';
+
+COMMENT ON COLUMN oauth2_provider_apps.logo_uri IS 'RFC 7591: URL of the client logo image';
+
+COMMENT ON COLUMN oauth2_provider_apps.tos_uri IS 'RFC 7591: URL of the client terms of service';
+
+COMMENT ON COLUMN oauth2_provider_apps.policy_uri IS 'RFC 7591: URL of the client privacy policy';
+
+COMMENT ON COLUMN oauth2_provider_apps.jwks_uri IS 'RFC 7591: URL of the client JSON Web Key Set';
+
+COMMENT ON COLUMN oauth2_provider_apps.jwks IS 'RFC 7591: JSON Web Key Set document value';
+
+COMMENT ON COLUMN oauth2_provider_apps.software_id IS 'RFC 7591: Identifier for the client software';
+
+COMMENT ON COLUMN oauth2_provider_apps.software_version IS 'RFC 7591: Version of the client software';
+
+COMMENT ON COLUMN oauth2_provider_apps.registration_access_token IS 'RFC 7592: Hashed registration access token for client management';
+
+COMMENT ON COLUMN oauth2_provider_apps.registration_client_uri IS 'RFC 7592: URI for client configuration endpoint';
+
 CREATE TABLE organizations (
     id uuid NOT NULL,
     name text NOT NULL,
@@ -2443,9 +2494,6 @@ ALTER TABLE ONLY oauth2_provider_app_tokens
 ALTER TABLE ONLY oauth2_provider_app_tokens
     ADD CONSTRAINT oauth2_provider_app_tokens_pkey PRIMARY KEY (id);
 
-ALTER TABLE ONLY oauth2_provider_apps
-    ADD CONSTRAINT oauth2_provider_apps_name_key UNIQUE (name);
-
 ALTER TABLE ONLY oauth2_provider_apps
     ADD CONSTRAINT oauth2_provider_apps_pkey PRIMARY KEY (id);
 
diff --git a/coderd/database/migrations/000347_oauth2_dynamic_registration.down.sql b/coderd/database/migrations/000347_oauth2_dynamic_registration.down.sql
new file mode 100644
index 0000000000000..ecaab2227a746
--- /dev/null
+++ b/coderd/database/migrations/000347_oauth2_dynamic_registration.down.sql
@@ -0,0 +1,30 @@
+-- Remove RFC 7591 Dynamic Client Registration fields from oauth2_provider_apps
+
+-- Remove RFC 7592 Management Fields
+ALTER TABLE oauth2_provider_apps
+    DROP COLUMN IF EXISTS registration_access_token,
+    DROP COLUMN IF EXISTS registration_client_uri;
+
+-- Remove RFC 7591 Advanced Fields
+ALTER TABLE oauth2_provider_apps
+    DROP COLUMN IF EXISTS jwks_uri,
+    DROP COLUMN IF EXISTS jwks,
+    DROP COLUMN IF EXISTS software_id,
+    DROP COLUMN IF EXISTS software_version;
+
+-- Remove RFC 7591 Optional Metadata Fields
+ALTER TABLE oauth2_provider_apps
+    DROP COLUMN IF EXISTS client_uri,
+    DROP COLUMN IF EXISTS logo_uri,
+    DROP COLUMN IF EXISTS tos_uri,
+    DROP COLUMN IF EXISTS policy_uri;
+
+-- Remove RFC 7591 Core Fields
+ALTER TABLE oauth2_provider_apps
+    DROP COLUMN IF EXISTS client_id_issued_at,
+    DROP COLUMN IF EXISTS client_secret_expires_at,
+    DROP COLUMN IF EXISTS grant_types,
+    DROP COLUMN IF EXISTS response_types,
+    DROP COLUMN IF EXISTS token_endpoint_auth_method,
+    DROP COLUMN IF EXISTS scope,
+    DROP COLUMN IF EXISTS contacts;
diff --git a/coderd/database/migrations/000347_oauth2_dynamic_registration.up.sql b/coderd/database/migrations/000347_oauth2_dynamic_registration.up.sql
new file mode 100644
index 0000000000000..4cadd845e0666
--- /dev/null
+++ b/coderd/database/migrations/000347_oauth2_dynamic_registration.up.sql
@@ -0,0 +1,64 @@
+-- Add RFC 7591 Dynamic Client Registration fields to oauth2_provider_apps
+
+-- RFC 7591 Core Fields
+ALTER TABLE oauth2_provider_apps
+    ADD COLUMN client_id_issued_at timestamptz DEFAULT NOW(),
+    ADD COLUMN client_secret_expires_at timestamptz,
+    ADD COLUMN grant_types text[] DEFAULT '{"authorization_code", "refresh_token"}',
+    ADD COLUMN response_types text[] DEFAULT '{"code"}',
+    ADD COLUMN token_endpoint_auth_method text DEFAULT 'client_secret_basic',
+    ADD COLUMN scope text DEFAULT '',
+    ADD COLUMN contacts text[];
+
+-- RFC 7591 Optional Metadata Fields
+ALTER TABLE oauth2_provider_apps
+    ADD COLUMN client_uri text,
+    ADD COLUMN logo_uri text,
+    ADD COLUMN tos_uri text,
+    ADD COLUMN policy_uri text;
+
+-- RFC 7591 Advanced Fields
+ALTER TABLE oauth2_provider_apps
+    ADD COLUMN jwks_uri text,
+    ADD COLUMN jwks jsonb,
+    ADD COLUMN software_id text,
+    ADD COLUMN software_version text;
+
+-- RFC 7592 Management Fields
+ALTER TABLE oauth2_provider_apps
+    ADD COLUMN registration_access_token text,
+    ADD COLUMN registration_client_uri text;
+
+-- Backfill existing records with proper defaults
+UPDATE oauth2_provider_apps SET
+    client_id_issued_at = COALESCE(client_id_issued_at, created_at),
+    grant_types = COALESCE(grant_types, '{"authorization_code", "refresh_token"}'),
+    response_types = COALESCE(response_types, '{"code"}'),
+    token_endpoint_auth_method = COALESCE(token_endpoint_auth_method, 'client_secret_basic'),
+    scope = COALESCE(scope, ''),
+    contacts = COALESCE(contacts, '{}')
+WHERE client_id_issued_at IS NULL
+   OR grant_types IS NULL
+   OR response_types IS NULL
+   OR token_endpoint_auth_method IS NULL
+   OR scope IS NULL
+   OR contacts IS NULL;
+
+-- Add comments for documentation
+COMMENT ON COLUMN oauth2_provider_apps.client_id_issued_at IS 'RFC 7591: Timestamp when client_id was issued';
+COMMENT ON COLUMN oauth2_provider_apps.client_secret_expires_at IS 'RFC 7591: Timestamp when client_secret expires (null for non-expiring)';
+COMMENT ON COLUMN oauth2_provider_apps.grant_types IS 'RFC 7591: Array of grant types the client is allowed to use';
+COMMENT ON COLUMN oauth2_provider_apps.response_types IS 'RFC 7591: Array of response types the client supports';
+COMMENT ON COLUMN oauth2_provider_apps.token_endpoint_auth_method IS 'RFC 7591: Authentication method for token endpoint';
+COMMENT ON COLUMN oauth2_provider_apps.scope IS 'RFC 7591: Space-delimited scope values the client can request';
+COMMENT ON COLUMN oauth2_provider_apps.contacts IS 'RFC 7591: Array of email addresses for responsible parties';
+COMMENT ON COLUMN oauth2_provider_apps.client_uri IS 'RFC 7591: URL of the client home page';
+COMMENT ON COLUMN oauth2_provider_apps.logo_uri IS 'RFC 7591: URL of the client logo image';
+COMMENT ON COLUMN oauth2_provider_apps.tos_uri IS 'RFC 7591: URL of the client terms of service';
+COMMENT ON COLUMN oauth2_provider_apps.policy_uri IS 'RFC 7591: URL of the client privacy policy';
+COMMENT ON COLUMN oauth2_provider_apps.jwks_uri IS 'RFC 7591: URL of the client JSON Web Key Set';
+COMMENT ON COLUMN oauth2_provider_apps.jwks IS 'RFC 7591: JSON Web Key Set document value';
+COMMENT ON COLUMN oauth2_provider_apps.software_id IS 'RFC 7591: Identifier for the client software';
+COMMENT ON COLUMN oauth2_provider_apps.software_version IS 'RFC 7591: Version of the client software';
+COMMENT ON COLUMN oauth2_provider_apps.registration_access_token IS 'RFC 7592: Hashed registration access token for client management';
+COMMENT ON COLUMN oauth2_provider_apps.registration_client_uri IS 'RFC 7592: URI for client configuration endpoint';
diff --git a/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.down.sql b/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.down.sql
new file mode 100644
index 0000000000000..eb9f3403a28f7
--- /dev/null
+++ b/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.down.sql
@@ -0,0 +1,3 @@
+-- Restore unique constraint on oauth2_provider_apps.name for rollback
+-- Note: This rollback may fail if duplicate names exist in the database
+ALTER TABLE oauth2_provider_apps ADD CONSTRAINT oauth2_provider_apps_name_key UNIQUE (name);
\ No newline at end of file
diff --git a/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.up.sql b/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.up.sql
new file mode 100644
index 0000000000000..f58fe959487c1
--- /dev/null
+++ b/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.up.sql
@@ -0,0 +1,3 @@
+-- Remove unique constraint on oauth2_provider_apps.name to comply with RFC 7591
+-- RFC 7591 does not require unique client names, only unique client IDs
+ALTER TABLE oauth2_provider_apps DROP CONSTRAINT oauth2_provider_apps_name_key;
\ No newline at end of file
diff --git a/coderd/database/models.go b/coderd/database/models.go
index a4012c34ff1ac..749de51118152 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -2989,6 +2989,40 @@ type OAuth2ProviderApp struct {
 	ClientType sql.NullString `db:"client_type" json:"client_type"`
 	// Whether this app was created via dynamic client registration
 	DynamicallyRegistered sql.NullBool `db:"dynamically_registered" json:"dynamically_registered"`
+	// RFC 7591: Timestamp when client_id was issued
+	ClientIDIssuedAt sql.NullTime `db:"client_id_issued_at" json:"client_id_issued_at"`
+	// RFC 7591: Timestamp when client_secret expires (null for non-expiring)
+	ClientSecretExpiresAt sql.NullTime `db:"client_secret_expires_at" json:"client_secret_expires_at"`
+	// RFC 7591: Array of grant types the client is allowed to use
+	GrantTypes []string `db:"grant_types" json:"grant_types"`
+	// RFC 7591: Array of response types the client supports
+	ResponseTypes []string `db:"response_types" json:"response_types"`
+	// RFC 7591: Authentication method for token endpoint
+	TokenEndpointAuthMethod sql.NullString `db:"token_endpoint_auth_method" json:"token_endpoint_auth_method"`
+	// RFC 7591: Space-delimited scope values the client can request
+	Scope sql.NullString `db:"scope" json:"scope"`
+	// RFC 7591: Array of email addresses for responsible parties
+	Contacts []string `db:"contacts" json:"contacts"`
+	// RFC 7591: URL of the client home page
+	ClientUri sql.NullString `db:"client_uri" json:"client_uri"`
+	// RFC 7591: URL of the client logo image
+	LogoUri sql.NullString `db:"logo_uri" json:"logo_uri"`
+	// RFC 7591: URL of the client terms of service
+	TosUri sql.NullString `db:"tos_uri" json:"tos_uri"`
+	// RFC 7591: URL of the client privacy policy
+	PolicyUri sql.NullString `db:"policy_uri" json:"policy_uri"`
+	// RFC 7591: URL of the client JSON Web Key Set
+	JwksUri sql.NullString `db:"jwks_uri" json:"jwks_uri"`
+	// RFC 7591: JSON Web Key Set document value
+	Jwks pqtype.NullRawMessage `db:"jwks" json:"jwks"`
+	// RFC 7591: Identifier for the client software
+	SoftwareID sql.NullString `db:"software_id" json:"software_id"`
+	// RFC 7591: Version of the client software
+	SoftwareVersion sql.NullString `db:"software_version" json:"software_version"`
+	// RFC 7592: Hashed registration access token for client management
+	RegistrationAccessToken sql.NullString `db:"registration_access_token" json:"registration_access_token"`
+	// RFC 7592: URI for client configuration endpoint
+	RegistrationClientUri sql.NullString `db:"registration_client_uri" json:"registration_client_uri"`
 }
 
 // Codes are meant to be exchanged for access tokens.
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 4b69e192738f4..dcbac88611dd0 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -6,6 +6,7 @@ package database
 
 import (
 	"context"
+	"database/sql"
 	"time"
 
 	"github.com/google/uuid"
@@ -88,6 +89,7 @@ type sqlcQuerier interface {
 	DeleteGroupByID(ctx context.Context, id uuid.UUID) error
 	DeleteGroupMemberFromGroup(ctx context.Context, arg DeleteGroupMemberFromGroupParams) error
 	DeleteLicense(ctx context.Context, id int32) (int32, error)
+	DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error
 	DeleteOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) error
 	DeleteOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) error
 	DeleteOAuth2ProviderAppCodesByAppAndUserID(ctx context.Context, arg DeleteOAuth2ProviderAppCodesByAppAndUserIDParams) error
@@ -218,7 +220,10 @@ type sqlcQuerier interface {
 	GetNotificationTemplatesByKind(ctx context.Context, kind NotificationTemplateKind) ([]NotificationTemplate, error)
 	GetNotificationsSettings(ctx context.Context) (string, error)
 	GetOAuth2GithubDefaultEligible(ctx context.Context) (bool, error)
+	// RFC 7591/7592 Dynamic Client Registration queries
+	GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error)
 	GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error)
+	GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (OAuth2ProviderApp, error)
 	GetOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderAppCode, error)
 	GetOAuth2ProviderAppCodeByPrefix(ctx context.Context, secretPrefix []byte) (OAuth2ProviderAppCode, error)
 	GetOAuth2ProviderAppSecretByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderAppSecret, error)
@@ -575,6 +580,7 @@ type sqlcQuerier interface {
 	UpdateMemberRoles(ctx context.Context, arg UpdateMemberRolesParams) (OrganizationMember, error)
 	UpdateMemoryResourceMonitor(ctx context.Context, arg UpdateMemoryResourceMonitorParams) error
 	UpdateNotificationTemplateMethodByID(ctx context.Context, arg UpdateNotificationTemplateMethodByIDParams) (NotificationTemplate, error)
+	UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg UpdateOAuth2ProviderAppByClientIDParams) (OAuth2ProviderApp, error)
 	UpdateOAuth2ProviderAppByID(ctx context.Context, arg UpdateOAuth2ProviderAppByIDParams) (OAuth2ProviderApp, error)
 	UpdateOAuth2ProviderAppSecretByID(ctx context.Context, arg UpdateOAuth2ProviderAppSecretByIDParams) (OAuth2ProviderAppSecret, error)
 	UpdateOrganization(ctx context.Context, arg UpdateOrganizationParams) (Organization, error)
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 580b621b0908a..15f4be06a3fa0 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -4759,6 +4759,15 @@ func (q *sqlQuerier) UpdateInboxNotificationReadStatus(ctx context.Context, arg
 	return err
 }
 
+const deleteOAuth2ProviderAppByClientID = `-- name: DeleteOAuth2ProviderAppByClientID :exec
+DELETE FROM oauth2_provider_apps WHERE id = $1
+`
+
+func (q *sqlQuerier) DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, deleteOAuth2ProviderAppByClientID, id)
+	return err
+}
+
 const deleteOAuth2ProviderAppByID = `-- name: DeleteOAuth2ProviderAppByID :exec
 DELETE FROM oauth2_provider_apps WHERE id = $1
 `
@@ -4821,8 +4830,48 @@ func (q *sqlQuerier) DeleteOAuth2ProviderAppTokensByAppAndUserID(ctx context.Con
 	return err
 }
 
+const getOAuth2ProviderAppByClientID = `-- name: GetOAuth2ProviderAppByClientID :one
+
+SELECT id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri FROM oauth2_provider_apps WHERE id = $1
+`
+
+// RFC 7591/7592 Dynamic Client Registration queries
+func (q *sqlQuerier) GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error) {
+	row := q.db.QueryRowContext(ctx, getOAuth2ProviderAppByClientID, id)
+	var i OAuth2ProviderApp
+	err := row.Scan(
+		&i.ID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.Name,
+		&i.Icon,
+		&i.CallbackURL,
+		pq.Array(&i.RedirectUris),
+		&i.ClientType,
+		&i.DynamicallyRegistered,
+		&i.ClientIDIssuedAt,
+		&i.ClientSecretExpiresAt,
+		pq.Array(&i.GrantTypes),
+		pq.Array(&i.ResponseTypes),
+		&i.TokenEndpointAuthMethod,
+		&i.Scope,
+		pq.Array(&i.Contacts),
+		&i.ClientUri,
+		&i.LogoUri,
+		&i.TosUri,
+		&i.PolicyUri,
+		&i.JwksUri,
+		&i.Jwks,
+		&i.SoftwareID,
+		&i.SoftwareVersion,
+		&i.RegistrationAccessToken,
+		&i.RegistrationClientUri,
+	)
+	return i, err
+}
+
 const getOAuth2ProviderAppByID = `-- name: GetOAuth2ProviderAppByID :one
-SELECT id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered FROM oauth2_provider_apps WHERE id = $1
+SELECT id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri FROM oauth2_provider_apps WHERE id = $1
 `
 
 func (q *sqlQuerier) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error) {
@@ -4838,6 +4887,61 @@ func (q *sqlQuerier) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID)
 		pq.Array(&i.RedirectUris),
 		&i.ClientType,
 		&i.DynamicallyRegistered,
+		&i.ClientIDIssuedAt,
+		&i.ClientSecretExpiresAt,
+		pq.Array(&i.GrantTypes),
+		pq.Array(&i.ResponseTypes),
+		&i.TokenEndpointAuthMethod,
+		&i.Scope,
+		pq.Array(&i.Contacts),
+		&i.ClientUri,
+		&i.LogoUri,
+		&i.TosUri,
+		&i.PolicyUri,
+		&i.JwksUri,
+		&i.Jwks,
+		&i.SoftwareID,
+		&i.SoftwareVersion,
+		&i.RegistrationAccessToken,
+		&i.RegistrationClientUri,
+	)
+	return i, err
+}
+
+const getOAuth2ProviderAppByRegistrationToken = `-- name: GetOAuth2ProviderAppByRegistrationToken :one
+SELECT id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri FROM oauth2_provider_apps WHERE registration_access_token = $1
+`
+
+func (q *sqlQuerier) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (OAuth2ProviderApp, error) {
+	row := q.db.QueryRowContext(ctx, getOAuth2ProviderAppByRegistrationToken, registrationAccessToken)
+	var i OAuth2ProviderApp
+	err := row.Scan(
+		&i.ID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.Name,
+		&i.Icon,
+		&i.CallbackURL,
+		pq.Array(&i.RedirectUris),
+		&i.ClientType,
+		&i.DynamicallyRegistered,
+		&i.ClientIDIssuedAt,
+		&i.ClientSecretExpiresAt,
+		pq.Array(&i.GrantTypes),
+		pq.Array(&i.ResponseTypes),
+		&i.TokenEndpointAuthMethod,
+		&i.Scope,
+		pq.Array(&i.Contacts),
+		&i.ClientUri,
+		&i.LogoUri,
+		&i.TosUri,
+		&i.PolicyUri,
+		&i.JwksUri,
+		&i.Jwks,
+		&i.SoftwareID,
+		&i.SoftwareVersion,
+		&i.RegistrationAccessToken,
+		&i.RegistrationClientUri,
 	)
 	return i, err
 }
@@ -5002,7 +5106,7 @@ func (q *sqlQuerier) GetOAuth2ProviderAppTokenByPrefix(ctx context.Context, hash
 }
 
 const getOAuth2ProviderApps = `-- name: GetOAuth2ProviderApps :many
-SELECT id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered FROM oauth2_provider_apps ORDER BY (name, id) ASC
+SELECT id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri FROM oauth2_provider_apps ORDER BY (name, id) ASC
 `
 
 func (q *sqlQuerier) GetOAuth2ProviderApps(ctx context.Context) ([]OAuth2ProviderApp, error) {
@@ -5024,6 +5128,23 @@ func (q *sqlQuerier) GetOAuth2ProviderApps(ctx context.Context) ([]OAuth2Provide
 			pq.Array(&i.RedirectUris),
 			&i.ClientType,
 			&i.DynamicallyRegistered,
+			&i.ClientIDIssuedAt,
+			&i.ClientSecretExpiresAt,
+			pq.Array(&i.GrantTypes),
+			pq.Array(&i.ResponseTypes),
+			&i.TokenEndpointAuthMethod,
+			&i.Scope,
+			pq.Array(&i.Contacts),
+			&i.ClientUri,
+			&i.LogoUri,
+			&i.TosUri,
+			&i.PolicyUri,
+			&i.JwksUri,
+			&i.Jwks,
+			&i.SoftwareID,
+			&i.SoftwareVersion,
+			&i.RegistrationAccessToken,
+			&i.RegistrationClientUri,
 		); err != nil {
 			return nil, err
 		}
@@ -5041,7 +5162,7 @@ func (q *sqlQuerier) GetOAuth2ProviderApps(ctx context.Context) ([]OAuth2Provide
 const getOAuth2ProviderAppsByUserID = `-- name: GetOAuth2ProviderAppsByUserID :many
 SELECT
   COUNT(DISTINCT oauth2_provider_app_tokens.id) as token_count,
-  oauth2_provider_apps.id, oauth2_provider_apps.created_at, oauth2_provider_apps.updated_at, oauth2_provider_apps.name, oauth2_provider_apps.icon, oauth2_provider_apps.callback_url, oauth2_provider_apps.redirect_uris, oauth2_provider_apps.client_type, oauth2_provider_apps.dynamically_registered
+  oauth2_provider_apps.id, oauth2_provider_apps.created_at, oauth2_provider_apps.updated_at, oauth2_provider_apps.name, oauth2_provider_apps.icon, oauth2_provider_apps.callback_url, oauth2_provider_apps.redirect_uris, oauth2_provider_apps.client_type, oauth2_provider_apps.dynamically_registered, oauth2_provider_apps.client_id_issued_at, oauth2_provider_apps.client_secret_expires_at, oauth2_provider_apps.grant_types, oauth2_provider_apps.response_types, oauth2_provider_apps.token_endpoint_auth_method, oauth2_provider_apps.scope, oauth2_provider_apps.contacts, oauth2_provider_apps.client_uri, oauth2_provider_apps.logo_uri, oauth2_provider_apps.tos_uri, oauth2_provider_apps.policy_uri, oauth2_provider_apps.jwks_uri, oauth2_provider_apps.jwks, oauth2_provider_apps.software_id, oauth2_provider_apps.software_version, oauth2_provider_apps.registration_access_token, oauth2_provider_apps.registration_client_uri
 FROM oauth2_provider_app_tokens
   INNER JOIN oauth2_provider_app_secrets
     ON oauth2_provider_app_secrets.id = oauth2_provider_app_tokens.app_secret_id
@@ -5078,6 +5199,23 @@ func (q *sqlQuerier) GetOAuth2ProviderAppsByUserID(ctx context.Context, userID u
 			pq.Array(&i.OAuth2ProviderApp.RedirectUris),
 			&i.OAuth2ProviderApp.ClientType,
 			&i.OAuth2ProviderApp.DynamicallyRegistered,
+			&i.OAuth2ProviderApp.ClientIDIssuedAt,
+			&i.OAuth2ProviderApp.ClientSecretExpiresAt,
+			pq.Array(&i.OAuth2ProviderApp.GrantTypes),
+			pq.Array(&i.OAuth2ProviderApp.ResponseTypes),
+			&i.OAuth2ProviderApp.TokenEndpointAuthMethod,
+			&i.OAuth2ProviderApp.Scope,
+			pq.Array(&i.OAuth2ProviderApp.Contacts),
+			&i.OAuth2ProviderApp.ClientUri,
+			&i.OAuth2ProviderApp.LogoUri,
+			&i.OAuth2ProviderApp.TosUri,
+			&i.OAuth2ProviderApp.PolicyUri,
+			&i.OAuth2ProviderApp.JwksUri,
+			&i.OAuth2ProviderApp.Jwks,
+			&i.OAuth2ProviderApp.SoftwareID,
+			&i.OAuth2ProviderApp.SoftwareVersion,
+			&i.OAuth2ProviderApp.RegistrationAccessToken,
+			&i.OAuth2ProviderApp.RegistrationClientUri,
 		); err != nil {
 			return nil, err
 		}
@@ -5102,7 +5240,24 @@ INSERT INTO oauth2_provider_apps (
     callback_url,
     redirect_uris,
     client_type,
-    dynamically_registered
+    dynamically_registered,
+    client_id_issued_at,
+    client_secret_expires_at,
+    grant_types,
+    response_types,
+    token_endpoint_auth_method,
+    scope,
+    contacts,
+    client_uri,
+    logo_uri,
+    tos_uri,
+    policy_uri,
+    jwks_uri,
+    jwks,
+    software_id,
+    software_version,
+    registration_access_token,
+    registration_client_uri
 ) VALUES(
     $1,
     $2,
@@ -5112,20 +5267,54 @@ INSERT INTO oauth2_provider_apps (
     $6,
     $7,
     $8,
-    $9
-) RETURNING id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered
+    $9,
+    $10,
+    $11,
+    $12,
+    $13,
+    $14,
+    $15,
+    $16,
+    $17,
+    $18,
+    $19,
+    $20,
+    $21,
+    $22,
+    $23,
+    $24,
+    $25,
+    $26
+) RETURNING id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri
 `
 
 type InsertOAuth2ProviderAppParams struct {
-	ID                    uuid.UUID      `db:"id" json:"id"`
-	CreatedAt             time.Time      `db:"created_at" json:"created_at"`
-	UpdatedAt             time.Time      `db:"updated_at" json:"updated_at"`
-	Name                  string         `db:"name" json:"name"`
-	Icon                  string         `db:"icon" json:"icon"`
-	CallbackURL           string         `db:"callback_url" json:"callback_url"`
-	RedirectUris          []string       `db:"redirect_uris" json:"redirect_uris"`
-	ClientType            sql.NullString `db:"client_type" json:"client_type"`
-	DynamicallyRegistered sql.NullBool   `db:"dynamically_registered" json:"dynamically_registered"`
+	ID                      uuid.UUID             `db:"id" json:"id"`
+	CreatedAt               time.Time             `db:"created_at" json:"created_at"`
+	UpdatedAt               time.Time             `db:"updated_at" json:"updated_at"`
+	Name                    string                `db:"name" json:"name"`
+	Icon                    string                `db:"icon" json:"icon"`
+	CallbackURL             string                `db:"callback_url" json:"callback_url"`
+	RedirectUris            []string              `db:"redirect_uris" json:"redirect_uris"`
+	ClientType              sql.NullString        `db:"client_type" json:"client_type"`
+	DynamicallyRegistered   sql.NullBool          `db:"dynamically_registered" json:"dynamically_registered"`
+	ClientIDIssuedAt        sql.NullTime          `db:"client_id_issued_at" json:"client_id_issued_at"`
+	ClientSecretExpiresAt   sql.NullTime          `db:"client_secret_expires_at" json:"client_secret_expires_at"`
+	GrantTypes              []string              `db:"grant_types" json:"grant_types"`
+	ResponseTypes           []string              `db:"response_types" json:"response_types"`
+	TokenEndpointAuthMethod sql.NullString        `db:"token_endpoint_auth_method" json:"token_endpoint_auth_method"`
+	Scope                   sql.NullString        `db:"scope" json:"scope"`
+	Contacts                []string              `db:"contacts" json:"contacts"`
+	ClientUri               sql.NullString        `db:"client_uri" json:"client_uri"`
+	LogoUri                 sql.NullString        `db:"logo_uri" json:"logo_uri"`
+	TosUri                  sql.NullString        `db:"tos_uri" json:"tos_uri"`
+	PolicyUri               sql.NullString        `db:"policy_uri" json:"policy_uri"`
+	JwksUri                 sql.NullString        `db:"jwks_uri" json:"jwks_uri"`
+	Jwks                    pqtype.NullRawMessage `db:"jwks" json:"jwks"`
+	SoftwareID              sql.NullString        `db:"software_id" json:"software_id"`
+	SoftwareVersion         sql.NullString        `db:"software_version" json:"software_version"`
+	RegistrationAccessToken sql.NullString        `db:"registration_access_token" json:"registration_access_token"`
+	RegistrationClientUri   sql.NullString        `db:"registration_client_uri" json:"registration_client_uri"`
 }
 
 func (q *sqlQuerier) InsertOAuth2ProviderApp(ctx context.Context, arg InsertOAuth2ProviderAppParams) (OAuth2ProviderApp, error) {
@@ -5139,6 +5328,23 @@ func (q *sqlQuerier) InsertOAuth2ProviderApp(ctx context.Context, arg InsertOAut
 		pq.Array(arg.RedirectUris),
 		arg.ClientType,
 		arg.DynamicallyRegistered,
+		arg.ClientIDIssuedAt,
+		arg.ClientSecretExpiresAt,
+		pq.Array(arg.GrantTypes),
+		pq.Array(arg.ResponseTypes),
+		arg.TokenEndpointAuthMethod,
+		arg.Scope,
+		pq.Array(arg.Contacts),
+		arg.ClientUri,
+		arg.LogoUri,
+		arg.TosUri,
+		arg.PolicyUri,
+		arg.JwksUri,
+		arg.Jwks,
+		arg.SoftwareID,
+		arg.SoftwareVersion,
+		arg.RegistrationAccessToken,
+		arg.RegistrationClientUri,
 	)
 	var i OAuth2ProviderApp
 	err := row.Scan(
@@ -5151,6 +5357,23 @@ func (q *sqlQuerier) InsertOAuth2ProviderApp(ctx context.Context, arg InsertOAut
 		pq.Array(&i.RedirectUris),
 		&i.ClientType,
 		&i.DynamicallyRegistered,
+		&i.ClientIDIssuedAt,
+		&i.ClientSecretExpiresAt,
+		pq.Array(&i.GrantTypes),
+		pq.Array(&i.ResponseTypes),
+		&i.TokenEndpointAuthMethod,
+		&i.Scope,
+		pq.Array(&i.Contacts),
+		&i.ClientUri,
+		&i.LogoUri,
+		&i.TosUri,
+		&i.PolicyUri,
+		&i.JwksUri,
+		&i.Jwks,
+		&i.SoftwareID,
+		&i.SoftwareVersion,
+		&i.RegistrationAccessToken,
+		&i.RegistrationClientUri,
 	)
 	return i, err
 }
@@ -5335,6 +5558,111 @@ func (q *sqlQuerier) InsertOAuth2ProviderAppToken(ctx context.Context, arg Inser
 	return i, err
 }
 
+const updateOAuth2ProviderAppByClientID = `-- name: UpdateOAuth2ProviderAppByClientID :one
+UPDATE oauth2_provider_apps SET
+    updated_at = $2,
+    name = $3,
+    icon = $4,
+    callback_url = $5,
+    redirect_uris = $6,
+    client_type = $7,
+    client_secret_expires_at = $8,
+    grant_types = $9,
+    response_types = $10,
+    token_endpoint_auth_method = $11,
+    scope = $12,
+    contacts = $13,
+    client_uri = $14,
+    logo_uri = $15,
+    tos_uri = $16,
+    policy_uri = $17,
+    jwks_uri = $18,
+    jwks = $19,
+    software_id = $20,
+    software_version = $21
+WHERE id = $1 RETURNING id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri
+`
+
+type UpdateOAuth2ProviderAppByClientIDParams struct {
+	ID                      uuid.UUID             `db:"id" json:"id"`
+	UpdatedAt               time.Time             `db:"updated_at" json:"updated_at"`
+	Name                    string                `db:"name" json:"name"`
+	Icon                    string                `db:"icon" json:"icon"`
+	CallbackURL             string                `db:"callback_url" json:"callback_url"`
+	RedirectUris            []string              `db:"redirect_uris" json:"redirect_uris"`
+	ClientType              sql.NullString        `db:"client_type" json:"client_type"`
+	ClientSecretExpiresAt   sql.NullTime          `db:"client_secret_expires_at" json:"client_secret_expires_at"`
+	GrantTypes              []string              `db:"grant_types" json:"grant_types"`
+	ResponseTypes           []string              `db:"response_types" json:"response_types"`
+	TokenEndpointAuthMethod sql.NullString        `db:"token_endpoint_auth_method" json:"token_endpoint_auth_method"`
+	Scope                   sql.NullString        `db:"scope" json:"scope"`
+	Contacts                []string              `db:"contacts" json:"contacts"`
+	ClientUri               sql.NullString        `db:"client_uri" json:"client_uri"`
+	LogoUri                 sql.NullString        `db:"logo_uri" json:"logo_uri"`
+	TosUri                  sql.NullString        `db:"tos_uri" json:"tos_uri"`
+	PolicyUri               sql.NullString        `db:"policy_uri" json:"policy_uri"`
+	JwksUri                 sql.NullString        `db:"jwks_uri" json:"jwks_uri"`
+	Jwks                    pqtype.NullRawMessage `db:"jwks" json:"jwks"`
+	SoftwareID              sql.NullString        `db:"software_id" json:"software_id"`
+	SoftwareVersion         sql.NullString        `db:"software_version" json:"software_version"`
+}
+
+func (q *sqlQuerier) UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg UpdateOAuth2ProviderAppByClientIDParams) (OAuth2ProviderApp, error) {
+	row := q.db.QueryRowContext(ctx, updateOAuth2ProviderAppByClientID,
+		arg.ID,
+		arg.UpdatedAt,
+		arg.Name,
+		arg.Icon,
+		arg.CallbackURL,
+		pq.Array(arg.RedirectUris),
+		arg.ClientType,
+		arg.ClientSecretExpiresAt,
+		pq.Array(arg.GrantTypes),
+		pq.Array(arg.ResponseTypes),
+		arg.TokenEndpointAuthMethod,
+		arg.Scope,
+		pq.Array(arg.Contacts),
+		arg.ClientUri,
+		arg.LogoUri,
+		arg.TosUri,
+		arg.PolicyUri,
+		arg.JwksUri,
+		arg.Jwks,
+		arg.SoftwareID,
+		arg.SoftwareVersion,
+	)
+	var i OAuth2ProviderApp
+	err := row.Scan(
+		&i.ID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.Name,
+		&i.Icon,
+		&i.CallbackURL,
+		pq.Array(&i.RedirectUris),
+		&i.ClientType,
+		&i.DynamicallyRegistered,
+		&i.ClientIDIssuedAt,
+		&i.ClientSecretExpiresAt,
+		pq.Array(&i.GrantTypes),
+		pq.Array(&i.ResponseTypes),
+		&i.TokenEndpointAuthMethod,
+		&i.Scope,
+		pq.Array(&i.Contacts),
+		&i.ClientUri,
+		&i.LogoUri,
+		&i.TosUri,
+		&i.PolicyUri,
+		&i.JwksUri,
+		&i.Jwks,
+		&i.SoftwareID,
+		&i.SoftwareVersion,
+		&i.RegistrationAccessToken,
+		&i.RegistrationClientUri,
+	)
+	return i, err
+}
+
 const updateOAuth2ProviderAppByID = `-- name: UpdateOAuth2ProviderAppByID :one
 UPDATE oauth2_provider_apps SET
     updated_at = $2,
@@ -5343,19 +5671,47 @@ UPDATE oauth2_provider_apps SET
     callback_url = $5,
     redirect_uris = $6,
     client_type = $7,
-    dynamically_registered = $8
-WHERE id = $1 RETURNING id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered
+    dynamically_registered = $8,
+    client_secret_expires_at = $9,
+    grant_types = $10,
+    response_types = $11,
+    token_endpoint_auth_method = $12,
+    scope = $13,
+    contacts = $14,
+    client_uri = $15,
+    logo_uri = $16,
+    tos_uri = $17,
+    policy_uri = $18,
+    jwks_uri = $19,
+    jwks = $20,
+    software_id = $21,
+    software_version = $22
+WHERE id = $1 RETURNING id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri
 `
 
 type UpdateOAuth2ProviderAppByIDParams struct {
-	ID                    uuid.UUID      `db:"id" json:"id"`
-	UpdatedAt             time.Time      `db:"updated_at" json:"updated_at"`
-	Name                  string         `db:"name" json:"name"`
-	Icon                  string         `db:"icon" json:"icon"`
-	CallbackURL           string         `db:"callback_url" json:"callback_url"`
-	RedirectUris          []string       `db:"redirect_uris" json:"redirect_uris"`
-	ClientType            sql.NullString `db:"client_type" json:"client_type"`
-	DynamicallyRegistered sql.NullBool   `db:"dynamically_registered" json:"dynamically_registered"`
+	ID                      uuid.UUID             `db:"id" json:"id"`
+	UpdatedAt               time.Time             `db:"updated_at" json:"updated_at"`
+	Name                    string                `db:"name" json:"name"`
+	Icon                    string                `db:"icon" json:"icon"`
+	CallbackURL             string                `db:"callback_url" json:"callback_url"`
+	RedirectUris            []string              `db:"redirect_uris" json:"redirect_uris"`
+	ClientType              sql.NullString        `db:"client_type" json:"client_type"`
+	DynamicallyRegistered   sql.NullBool          `db:"dynamically_registered" json:"dynamically_registered"`
+	ClientSecretExpiresAt   sql.NullTime          `db:"client_secret_expires_at" json:"client_secret_expires_at"`
+	GrantTypes              []string              `db:"grant_types" json:"grant_types"`
+	ResponseTypes           []string              `db:"response_types" json:"response_types"`
+	TokenEndpointAuthMethod sql.NullString        `db:"token_endpoint_auth_method" json:"token_endpoint_auth_method"`
+	Scope                   sql.NullString        `db:"scope" json:"scope"`
+	Contacts                []string              `db:"contacts" json:"contacts"`
+	ClientUri               sql.NullString        `db:"client_uri" json:"client_uri"`
+	LogoUri                 sql.NullString        `db:"logo_uri" json:"logo_uri"`
+	TosUri                  sql.NullString        `db:"tos_uri" json:"tos_uri"`
+	PolicyUri               sql.NullString        `db:"policy_uri" json:"policy_uri"`
+	JwksUri                 sql.NullString        `db:"jwks_uri" json:"jwks_uri"`
+	Jwks                    pqtype.NullRawMessage `db:"jwks" json:"jwks"`
+	SoftwareID              sql.NullString        `db:"software_id" json:"software_id"`
+	SoftwareVersion         sql.NullString        `db:"software_version" json:"software_version"`
 }
 
 func (q *sqlQuerier) UpdateOAuth2ProviderAppByID(ctx context.Context, arg UpdateOAuth2ProviderAppByIDParams) (OAuth2ProviderApp, error) {
@@ -5368,6 +5724,20 @@ func (q *sqlQuerier) UpdateOAuth2ProviderAppByID(ctx context.Context, arg Update
 		pq.Array(arg.RedirectUris),
 		arg.ClientType,
 		arg.DynamicallyRegistered,
+		arg.ClientSecretExpiresAt,
+		pq.Array(arg.GrantTypes),
+		pq.Array(arg.ResponseTypes),
+		arg.TokenEndpointAuthMethod,
+		arg.Scope,
+		pq.Array(arg.Contacts),
+		arg.ClientUri,
+		arg.LogoUri,
+		arg.TosUri,
+		arg.PolicyUri,
+		arg.JwksUri,
+		arg.Jwks,
+		arg.SoftwareID,
+		arg.SoftwareVersion,
 	)
 	var i OAuth2ProviderApp
 	err := row.Scan(
@@ -5380,6 +5750,23 @@ func (q *sqlQuerier) UpdateOAuth2ProviderAppByID(ctx context.Context, arg Update
 		pq.Array(&i.RedirectUris),
 		&i.ClientType,
 		&i.DynamicallyRegistered,
+		&i.ClientIDIssuedAt,
+		&i.ClientSecretExpiresAt,
+		pq.Array(&i.GrantTypes),
+		pq.Array(&i.ResponseTypes),
+		&i.TokenEndpointAuthMethod,
+		&i.Scope,
+		pq.Array(&i.Contacts),
+		&i.ClientUri,
+		&i.LogoUri,
+		&i.TosUri,
+		&i.PolicyUri,
+		&i.JwksUri,
+		&i.Jwks,
+		&i.SoftwareID,
+		&i.SoftwareVersion,
+		&i.RegistrationAccessToken,
+		&i.RegistrationClientUri,
 	)
 	return i, err
 }
diff --git a/coderd/database/queries/oauth2.sql b/coderd/database/queries/oauth2.sql
index eacd83145e67f..8e177a2a34177 100644
--- a/coderd/database/queries/oauth2.sql
+++ b/coderd/database/queries/oauth2.sql
@@ -14,7 +14,24 @@ INSERT INTO oauth2_provider_apps (
     callback_url,
     redirect_uris,
     client_type,
-    dynamically_registered
+    dynamically_registered,
+    client_id_issued_at,
+    client_secret_expires_at,
+    grant_types,
+    response_types,
+    token_endpoint_auth_method,
+    scope,
+    contacts,
+    client_uri,
+    logo_uri,
+    tos_uri,
+    policy_uri,
+    jwks_uri,
+    jwks,
+    software_id,
+    software_version,
+    registration_access_token,
+    registration_client_uri
 ) VALUES(
     $1,
     $2,
@@ -24,7 +41,24 @@ INSERT INTO oauth2_provider_apps (
     $6,
     $7,
     $8,
-    $9
+    $9,
+    $10,
+    $11,
+    $12,
+    $13,
+    $14,
+    $15,
+    $16,
+    $17,
+    $18,
+    $19,
+    $20,
+    $21,
+    $22,
+    $23,
+    $24,
+    $25,
+    $26
 ) RETURNING *;
 
 -- name: UpdateOAuth2ProviderAppByID :one
@@ -35,7 +69,21 @@ UPDATE oauth2_provider_apps SET
     callback_url = $5,
     redirect_uris = $6,
     client_type = $7,
-    dynamically_registered = $8
+    dynamically_registered = $8,
+    client_secret_expires_at = $9,
+    grant_types = $10,
+    response_types = $11,
+    token_endpoint_auth_method = $12,
+    scope = $13,
+    contacts = $14,
+    client_uri = $15,
+    logo_uri = $16,
+    tos_uri = $17,
+    policy_uri = $18,
+    jwks_uri = $19,
+    jwks = $20,
+    software_id = $21,
+    software_version = $22
 WHERE id = $1 RETURNING *;
 
 -- name: DeleteOAuth2ProviderAppByID :exec
@@ -164,3 +212,38 @@ WHERE
   oauth2_provider_app_secrets.id = oauth2_provider_app_tokens.app_secret_id
   AND oauth2_provider_app_secrets.app_id = $1
   AND oauth2_provider_app_tokens.user_id = $2;
+
+-- RFC 7591/7592 Dynamic Client Registration queries
+
+-- name: GetOAuth2ProviderAppByClientID :one
+SELECT * FROM oauth2_provider_apps WHERE id = $1;
+
+-- name: UpdateOAuth2ProviderAppByClientID :one
+UPDATE oauth2_provider_apps SET
+    updated_at = $2,
+    name = $3,
+    icon = $4,
+    callback_url = $5,
+    redirect_uris = $6,
+    client_type = $7,
+    client_secret_expires_at = $8,
+    grant_types = $9,
+    response_types = $10,
+    token_endpoint_auth_method = $11,
+    scope = $12,
+    contacts = $13,
+    client_uri = $14,
+    logo_uri = $15,
+    tos_uri = $16,
+    policy_uri = $17,
+    jwks_uri = $18,
+    jwks = $19,
+    software_id = $20,
+    software_version = $21
+WHERE id = $1 RETURNING *;
+
+-- name: DeleteOAuth2ProviderAppByClientID :exec
+DELETE FROM oauth2_provider_apps WHERE id = $1;
+
+-- name: GetOAuth2ProviderAppByRegistrationToken :one
+SELECT * FROM oauth2_provider_apps WHERE registration_access_token = $1;
diff --git a/coderd/database/unique_constraint.go b/coderd/database/unique_constraint.go
index 8377c630a6d92..b3af136997c9c 100644
--- a/coderd/database/unique_constraint.go
+++ b/coderd/database/unique_constraint.go
@@ -36,7 +36,6 @@ const (
 	UniqueOauth2ProviderAppSecretsSecretPrefixKey             UniqueConstraint = "oauth2_provider_app_secrets_secret_prefix_key"                   // ALTER TABLE ONLY oauth2_provider_app_secrets ADD CONSTRAINT oauth2_provider_app_secrets_secret_prefix_key UNIQUE (secret_prefix);
 	UniqueOauth2ProviderAppTokensHashPrefixKey                UniqueConstraint = "oauth2_provider_app_tokens_hash_prefix_key"                      // ALTER TABLE ONLY oauth2_provider_app_tokens ADD CONSTRAINT oauth2_provider_app_tokens_hash_prefix_key UNIQUE (hash_prefix);
 	UniqueOauth2ProviderAppTokensPkey                         UniqueConstraint = "oauth2_provider_app_tokens_pkey"                                 // ALTER TABLE ONLY oauth2_provider_app_tokens ADD CONSTRAINT oauth2_provider_app_tokens_pkey PRIMARY KEY (id);
-	UniqueOauth2ProviderAppsNameKey                           UniqueConstraint = "oauth2_provider_apps_name_key"                                   // ALTER TABLE ONLY oauth2_provider_apps ADD CONSTRAINT oauth2_provider_apps_name_key UNIQUE (name);
 	UniqueOauth2ProviderAppsPkey                              UniqueConstraint = "oauth2_provider_apps_pkey"                                       // ALTER TABLE ONLY oauth2_provider_apps ADD CONSTRAINT oauth2_provider_apps_pkey PRIMARY KEY (id);
 	UniqueOrganizationMembersPkey                             UniqueConstraint = "organization_members_pkey"                                       // ALTER TABLE ONLY organization_members ADD CONSTRAINT organization_members_pkey PRIMARY KEY (organization_id, user_id);
 	UniqueOrganizationsPkey                                   UniqueConstraint = "organizations_pkey"                                              // ALTER TABLE ONLY organizations ADD CONSTRAINT organizations_pkey PRIMARY KEY (id);
diff --git a/coderd/dynamicparameters/error.go b/coderd/dynamicparameters/error.go
index 3af270569acea..4c27905bfa832 100644
--- a/coderd/dynamicparameters/error.go
+++ b/coderd/dynamicparameters/error.go
@@ -10,7 +10,7 @@ import (
 	"github.com/coder/coder/v2/codersdk"
 )
 
-func ParameterValidationError(diags hcl.Diagnostics) *DiagnosticError {
+func parameterValidationError(diags hcl.Diagnostics) *DiagnosticError {
 	return &DiagnosticError{
 		Message:          "Unable to validate parameters",
 		Diagnostics:      diags,
@@ -18,9 +18,9 @@ func ParameterValidationError(diags hcl.Diagnostics) *DiagnosticError {
 	}
 }
 
-func TagValidationError(diags hcl.Diagnostics) *DiagnosticError {
+func tagValidationError(diags hcl.Diagnostics) *DiagnosticError {
 	return &DiagnosticError{
-		Message:          "Failed to parse workspace tags",
+		Message:          "Unable to parse workspace tags",
 		Diagnostics:      diags,
 		KeyedDiagnostics: make(map[string]hcl.Diagnostics),
 	}
diff --git a/coderd/dynamicparameters/render.go b/coderd/dynamicparameters/render.go
index 05c0f1b6c68c9..8a5a80cd25d22 100644
--- a/coderd/dynamicparameters/render.go
+++ b/coderd/dynamicparameters/render.go
@@ -243,7 +243,28 @@ func (r *dynamicRenderer) getWorkspaceOwnerData(ctx context.Context, ownerID uui
 		return nil // already fetched
 	}
 
-	user, err := r.db.GetUserByID(ctx, ownerID)
+	owner, err := WorkspaceOwner(ctx, r.db, r.data.templateVersion.OrganizationID, ownerID)
+	if err != nil {
+		return err
+	}
+
+	r.currentOwner = owner
+	return nil
+}
+
+func (r *dynamicRenderer) Close() {
+	r.once.Do(r.close)
+}
+
+func ProvisionerVersionSupportsDynamicParameters(version string) bool {
+	major, minor, err := apiversion.Parse(version)
+	// If the api version is not valid or less than 1.6, we need to use the static parameters
+	useStaticParams := err != nil || major < 1 || (major == 1 && minor < 6)
+	return !useStaticParams
+}
+
+func WorkspaceOwner(ctx context.Context, db database.Store, org uuid.UUID, ownerID uuid.UUID) (*previewtypes.WorkspaceOwner, error) {
+	user, err := db.GetUserByID(ctx, ownerID)
 	if err != nil {
 		// If the user failed to read, we also try to read the user from their
 		// organization member. You only need to be able to read the organization member
@@ -252,37 +273,37 @@ func (r *dynamicRenderer) getWorkspaceOwnerData(ctx context.Context, ownerID uui
 		// Only the terraform files can therefore leak more information than the
 		// caller should have access to. All this info should be public assuming you can
 		// read the user though.
-		mem, err := database.ExpectOne(r.db.OrganizationMembers(ctx, database.OrganizationMembersParams{
-			OrganizationID: r.data.templateVersion.OrganizationID,
+		mem, err := database.ExpectOne(db.OrganizationMembers(ctx, database.OrganizationMembersParams{
+			OrganizationID: org,
 			UserID:         ownerID,
 			IncludeSystem:  true,
 		}))
 		if err != nil {
-			return xerrors.Errorf("fetch user: %w", err)
+			return nil, xerrors.Errorf("fetch user: %w", err)
 		}
 
 		// Org member fetched, so use the provisioner context to fetch the user.
 		//nolint:gocritic // Has the correct permissions, and matches the provisioning flow.
-		user, err = r.db.GetUserByID(dbauthz.AsProvisionerd(ctx), mem.OrganizationMember.UserID)
+		user, err = db.GetUserByID(dbauthz.AsProvisionerd(ctx), mem.OrganizationMember.UserID)
 		if err != nil {
-			return xerrors.Errorf("fetch user: %w", err)
+			return nil, xerrors.Errorf("fetch user: %w", err)
 		}
 	}
 
 	// nolint:gocritic // This is kind of the wrong query to use here, but it
 	// matches how the provisioner currently works. We should figure out
 	// something that needs less escalation but has the correct behavior.
-	row, err := r.db.GetAuthorizationUserRoles(dbauthz.AsProvisionerd(ctx), ownerID)
+	row, err := db.GetAuthorizationUserRoles(dbauthz.AsProvisionerd(ctx), ownerID)
 	if err != nil {
-		return xerrors.Errorf("user roles: %w", err)
+		return nil, xerrors.Errorf("user roles: %w", err)
 	}
 	roles, err := row.RoleNames()
 	if err != nil {
-		return xerrors.Errorf("expand roles: %w", err)
+		return nil, xerrors.Errorf("expand roles: %w", err)
 	}
 	ownerRoles := make([]previewtypes.WorkspaceOwnerRBACRole, 0, len(roles))
 	for _, it := range roles {
-		if it.OrganizationID != uuid.Nil && it.OrganizationID != r.data.templateVersion.OrganizationID {
+		if it.OrganizationID != uuid.Nil && it.OrganizationID != org {
 			continue
 		}
 		var orgID string
@@ -298,28 +319,28 @@ func (r *dynamicRenderer) getWorkspaceOwnerData(ctx context.Context, ownerID uui
 	// The correct public key has to be sent. This will not be leaked
 	// unless the template leaks it.
 	// nolint:gocritic
-	key, err := r.db.GetGitSSHKey(dbauthz.AsProvisionerd(ctx), ownerID)
+	key, err := db.GetGitSSHKey(dbauthz.AsProvisionerd(ctx), ownerID)
 	if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
-		return xerrors.Errorf("ssh key: %w", err)
+		return nil, xerrors.Errorf("ssh key: %w", err)
 	}
 
 	// The groups need to be sent to preview. These groups are not exposed to the
 	// user, unless the template does it through the parameters. Regardless, we need
 	// the correct groups, and a user might not have read access.
 	// nolint:gocritic
-	groups, err := r.db.GetGroups(dbauthz.AsProvisionerd(ctx), database.GetGroupsParams{
-		OrganizationID: r.data.templateVersion.OrganizationID,
+	groups, err := db.GetGroups(dbauthz.AsProvisionerd(ctx), database.GetGroupsParams{
+		OrganizationID: org,
 		HasMemberID:    ownerID,
 	})
 	if err != nil {
-		return xerrors.Errorf("groups: %w", err)
+		return nil, xerrors.Errorf("groups: %w", err)
 	}
 	groupNames := make([]string, 0, len(groups))
 	for _, it := range groups {
 		groupNames = append(groupNames, it.Group.Name)
 	}
 
-	r.currentOwner = &previewtypes.WorkspaceOwner{
+	return &previewtypes.WorkspaceOwner{
 		ID:           user.ID.String(),
 		Name:         user.Username,
 		FullName:     user.Name,
@@ -328,17 +349,5 @@ func (r *dynamicRenderer) getWorkspaceOwnerData(ctx context.Context, ownerID uui
 		RBACRoles:    ownerRoles,
 		SSHPublicKey: key.PublicKey,
 		Groups:       groupNames,
-	}
-	return nil
-}
-
-func (r *dynamicRenderer) Close() {
-	r.once.Do(r.close)
-}
-
-func ProvisionerVersionSupportsDynamicParameters(version string) bool {
-	major, minor, err := apiversion.Parse(version)
-	// If the api version is not valid or less than 1.6, we need to use the static parameters
-	useStaticParams := err != nil || major < 1 || (major == 1 && minor < 6)
-	return !useStaticParams
+	}, nil
 }
diff --git a/coderd/dynamicparameters/resolver.go b/coderd/dynamicparameters/resolver.go
index 7007fccc9f213..bd8e2294cf136 100644
--- a/coderd/dynamicparameters/resolver.go
+++ b/coderd/dynamicparameters/resolver.go
@@ -73,7 +73,7 @@ func ResolveParameters(
 		// always be valid. If there is a case where this is not true, then this has to
 		// be changed to allow the build to continue with a different set of values.
 
-		return nil, ParameterValidationError(diags)
+		return nil, parameterValidationError(diags)
 	}
 
 	// The user's input now needs to be validated against the parameters.
@@ -113,13 +113,13 @@ func ResolveParameters(
 	// are fatal. Additional validation for immutability has to be done manually.
 	output, diags = renderer.Render(ctx, ownerID, values.ValuesMap())
 	if diags.HasErrors() {
-		return nil, ParameterValidationError(diags)
+		return nil, parameterValidationError(diags)
 	}
 
 	// parameterNames is going to be used to remove any excess values that were left
 	// around without a parameter.
 	parameterNames := make(map[string]struct{}, len(output.Parameters))
-	parameterError := ParameterValidationError(nil)
+	parameterError := parameterValidationError(nil)
 	for _, parameter := range output.Parameters {
 		parameterNames[parameter.Name] = struct{}{}
 
diff --git a/coderd/dynamicparameters/tags.go b/coderd/dynamicparameters/tags.go
new file mode 100644
index 0000000000000..38a9bf4691571
--- /dev/null
+++ b/coderd/dynamicparameters/tags.go
@@ -0,0 +1,100 @@
+package dynamicparameters
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/hcl/v2"
+
+	"github.com/coder/preview"
+	previewtypes "github.com/coder/preview/types"
+)
+
+func CheckTags(output *preview.Output, diags hcl.Diagnostics) *DiagnosticError {
+	de := tagValidationError(diags)
+	failedTags := output.WorkspaceTags.UnusableTags()
+	if len(failedTags) == 0 && !de.HasError() {
+		return nil // No errors, all is good!
+	}
+
+	for _, tag := range failedTags {
+		name := tag.KeyString()
+		if name == previewtypes.UnknownStringValue {
+			name = "unknown" // Best effort to get a name for the tag
+		}
+		de.Extend(name, failedTagDiagnostic(tag))
+	}
+	return de
+}
+
+// failedTagDiagnostic is a helper function that takes an invalid tag and
+// returns an appropriate hcl diagnostic for it.
+func failedTagDiagnostic(tag previewtypes.Tag) hcl.Diagnostics {
+	const (
+		key   = "key"
+		value = "value"
+	)
+
+	diags := hcl.Diagnostics{}
+
+	// TODO: It would be really nice to pull out the variable references to help identify the source of
+	// the unknown or invalid tag.
+	unknownErr := "Tag %s is not known, it likely refers to a variable that is not set or has no default."
+	invalidErr := "Tag %s is not valid, it must be a non-null string value."
+
+	if !tag.Key.Value.IsWhollyKnown() {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  fmt.Sprintf(unknownErr, key),
+		})
+	} else if !tag.Key.Valid() {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  fmt.Sprintf(invalidErr, key),
+		})
+	}
+
+	if !tag.Value.Value.IsWhollyKnown() {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  fmt.Sprintf(unknownErr, value),
+		})
+	} else if !tag.Value.Valid() {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  fmt.Sprintf(invalidErr, value),
+		})
+	}
+
+	if diags.HasErrors() {
+		// Stop here if there are diags, as the diags manually created above are more
+		// informative than the original tag's diagnostics.
+		return diags
+	}
+
+	// If we reach here, decorate the original tag's diagnostics
+	diagErr := "Tag %s: %s"
+	if tag.Key.ValueDiags.HasErrors() {
+		// add 'Tag key' prefix to each diagnostic
+		for _, d := range tag.Key.ValueDiags {
+			d.Summary = fmt.Sprintf(diagErr, key, d.Summary)
+		}
+	}
+	diags = diags.Extend(tag.Key.ValueDiags)
+
+	if tag.Value.ValueDiags.HasErrors() {
+		// add 'Tag value' prefix to each diagnostic
+		for _, d := range tag.Value.ValueDiags {
+			d.Summary = fmt.Sprintf(diagErr, value, d.Summary)
+		}
+	}
+	diags = diags.Extend(tag.Value.ValueDiags)
+
+	if !diags.HasErrors() {
+		diags = diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Tag is invalid for some unknown reason. Please check the tag's value and key.",
+		})
+	}
+
+	return diags
+}
diff --git a/coderd/dynamicparameters/tags_internal_test.go b/coderd/dynamicparameters/tags_internal_test.go
new file mode 100644
index 0000000000000..2636996520ebd
--- /dev/null
+++ b/coderd/dynamicparameters/tags_internal_test.go
@@ -0,0 +1,667 @@
+package dynamicparameters
+
+import (
+	"archive/zip"
+	"bytes"
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/spf13/afero/zipfs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	archivefs "github.com/coder/coder/v2/archive/fs"
+	"github.com/coder/preview"
+
+	"github.com/coder/coder/v2/testutil"
+)
+
+func Test_DynamicWorkspaceTagDefaultsFromFile(t *testing.T) {
+	t.Parallel()
+
+	const (
+		unknownTag       = "Tag value is not known"
+		invalidValueType = "Tag value is not valid"
+	)
+
+	for _, tc := range []struct {
+		name               string
+		files              map[string]string
+		expectTags         map[string]string
+		expectedFailedTags map[string]string
+		expectedError      string
+	}{
+		{
+			name: "single text file",
+			files: map[string]string{
+				"file.txt": `
+					hello world`,
+			},
+			expectTags: map[string]string{},
+		},
+		{
+			name: "main.tf with no workspace_tags",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+						name = "az"
+						type = "string"
+						default = "a"
+					}`,
+			},
+			expectTags: map[string]string{},
+		},
+		{
+			name: "main.tf with empty workspace tags",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+						name = "az"
+						type = "string"
+						default = "a"
+					}
+					data "coder_workspace_tags" "tags" {}`,
+			},
+			expectTags: map[string]string{},
+		},
+		{
+			name: "main.tf with valid workspace tags",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					variable "unrelated" {
+						type = bool
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+					  name = "az"
+						type = "string"
+						default = "a"
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"platform" = "kubernetes",
+							"cluster"  = "${"devel"}${"opers"}"
+							"region"   = var.region
+							"az"       = data.coder_parameter.az.value
+						}
+					}`,
+			},
+			expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "us", "az": "a"},
+		},
+		{
+			name: "main.tf with parameter that has default value from dynamic value",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					variable "az" {
+						type    = string
+						default = "${""}${"a"}"
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+						name = "az"
+						type = "string"
+						default = var.az
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"platform" = "kubernetes",
+							"cluster"  = "${"devel"}${"opers"}"
+							"region"   = var.region
+							"az"       = data.coder_parameter.az.value
+						}
+					}`,
+			},
+			expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "us", "az": "a"},
+		},
+		{
+			name: "main.tf with parameter that has default value from another parameter",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+						name = "az"
+						type    = string
+						default = "${""}${"a"}"
+					}
+					data "coder_parameter" "az2" {
+					  	name = "az2"
+						type = "string"
+						default = data.coder_parameter.az.value
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"platform" = "kubernetes",
+							"cluster"  = "${"devel"}${"opers"}"
+							"region"   = var.region
+							"az"       = data.coder_parameter.az2.value
+						}
+					}`,
+			},
+			expectTags: map[string]string{
+				"platform": "kubernetes",
+				"cluster":  "developers",
+				"region":   "us",
+				"az":       "a",
+			},
+		},
+		{
+			name: "main.tf with multiple valid workspace tags",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					variable "region2" {
+						type    = string
+						default = "eu"
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+					  	name = "az"
+						type = "string"
+						default = "a"
+					}
+					data "coder_parameter" "az2" {
+					  	name = "az2"
+						type = "string"
+						default = "b"
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"platform" = "kubernetes",
+							"cluster"  = "${"devel"}${"opers"}"
+							"region"   = var.region
+							"az"       = data.coder_parameter.az.value
+						}
+					}
+					data "coder_workspace_tags" "more_tags" {
+						tags = {
+							"foo" = "bar"
+						}
+					}`,
+			},
+			expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "us", "az": "a", "foo": "bar"},
+		},
+		{
+			name: "main.tf with missing parameter default value for workspace tags",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+						name = "az"
+						type = "string"
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"platform" = "kubernetes",
+							"cluster"  = "${"devel"}${"opers"}"
+							"region"   = var.region
+							"az"       = data.coder_parameter.az.value
+						}
+					}`,
+			},
+			expectTags: map[string]string{"cluster": "developers", "platform": "kubernetes", "region": "us"},
+			expectedFailedTags: map[string]string{
+				"az": "Tag value is not known, it likely refers to a variable that is not set or has no default.",
+			},
+		},
+		{
+			name: "main.tf with missing parameter default value outside workspace tags",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+						name = "az"
+						type = "string"
+						default = "a"
+					}
+					data "coder_parameter" "notaz" {
+						name = "notaz"
+						type = "string"
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"platform" = "kubernetes",
+							"cluster"  = "${"devel"}${"opers"}"
+							"region"   = var.region
+							"az"       = data.coder_parameter.az.value
+						}
+					}`,
+			},
+			expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "us", "az": "a"},
+		},
+		{
+			name: "main.tf with missing variable default value outside workspace tags",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					variable "notregion" {
+						type = string
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+						name = "az"
+						type = "string"
+						default = "a"
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"platform"  = "kubernetes",
+							"cluster"   = "${"devel"}${"opers"}"
+							"region"    = var.region
+							"az"        = data.coder_parameter.az.value
+						}
+					}`,
+			},
+			expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "us", "az": "a"},
+		},
+		{
+			name: "main.tf with disallowed data source for workspace tags",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {
+						name = "foobar"
+					}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+						name = "az"
+						type = "string"
+						default = "a"
+					}
+					data "local_file" "hostname" {
+						filename = "/etc/hostname"
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"platform"  = "kubernetes",
+							"cluster"   = "${"devel"}${"opers"}"
+							"region"    = var.region
+							"az"        = data.coder_parameter.az.value
+							"hostname"  = data.local_file.hostname.content
+						}
+					}`,
+			},
+			expectTags: map[string]string{
+				"platform": "kubernetes",
+				"cluster":  "developers",
+				"region":   "us",
+				"az":       "a",
+			},
+			expectedFailedTags: map[string]string{
+				"hostname": unknownTag,
+			},
+		},
+		{
+			name: "main.tf with disallowed resource for workspace tags",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {
+						name = "foobar"
+					}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+						name = "az"
+						type = "string"
+						default = "a"
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"platform"  = "kubernetes",
+							"cluster"   = "${"devel"}${"opers"}"
+							"region"    = var.region
+							"az"        = data.coder_parameter.az.value
+							"foobarbaz" = foo_bar.baz.name
+						}
+					}`,
+			},
+			expectTags: map[string]string{
+				"platform":  "kubernetes",
+				"cluster":   "developers",
+				"region":    "us",
+				"az":        "a",
+				"foobarbaz": "foobar",
+			},
+		},
+		{
+			name: "main.tf with allowed functions in workspace tags",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {
+						name = "foobar"
+					}
+					locals {
+						some_path = pathexpand("file.txt")
+					}
+					variable "region" {
+						type    = string
+						default = "us"
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+						name = "az"
+						type = "string"
+						default = "a"
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"platform"  = "kubernetes",
+							"cluster"   = "${"devel"}${"opers"}"
+							"region"    = try(split(".", var.region)[1], "placeholder")
+							"az"        = try(split(".", data.coder_parameter.az.value)[1], "placeholder")
+						}
+					}`,
+			},
+			expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "placeholder", "az": "placeholder"},
+		},
+		{
+			// Trying to use '~' in a path expand is not allowed, as there is
+			// no concept of home directory in preview.
+			name: "main.tf with disallowed functions in workspace tags",
+			files: map[string]string{
+				"main.tf": `
+					provider "foo" {}
+					resource "foo_bar" "baz" {
+						name = "foobar"
+					}
+					locals {
+						some_path = pathexpand("file.txt")
+					}
+					variable "region" {
+						type    = string
+						default = "region.us"
+					}
+					data "coder_parameter" "unrelated" {
+						name    = "unrelated"
+						type    = "list(string)"
+						default = jsonencode(["a", "b"])
+					}
+					data "coder_parameter" "az" {
+						name = "az"
+						type = "string"
+						default = "az.a"
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"platform"  = "kubernetes",
+							"cluster"   = "${"devel"}${"opers"}"
+							"region"    = try(split(".", var.region)[1], "placeholder")
+							"az"        = try(split(".", data.coder_parameter.az.value)[1], "placeholder")
+							"some_path" = pathexpand("~/file.txt")
+						}
+					}`,
+			},
+			expectTags: map[string]string{
+				"platform": "kubernetes",
+				"cluster":  "developers",
+				"region":   "us",
+				"az":       "a",
+			},
+			expectedFailedTags: map[string]string{
+				"some_path": unknownTag,
+			},
+		},
+		{
+			name: "supported types",
+			files: map[string]string{
+				"main.tf": `
+					variable "stringvar" {
+						type    = string
+						default = "a"
+					}
+					variable "numvar" {
+						type    = number
+						default = 1
+					}
+					variable "boolvar" {
+						type    = bool
+						default = true
+					}
+					variable "listvar" {
+						type    = list(string)
+						default = ["a"]
+					}
+					variable "mapvar" {
+						type    = map(string)
+						default = {"a": "b"}
+					}
+					data "coder_parameter" "stringparam" {
+						name    = "stringparam"
+						type    = "string"
+						default = "a"
+					}
+					data "coder_parameter" "numparam" {
+						name    = "numparam"
+						type    = "number"
+						default = 1
+					}
+					data "coder_parameter" "boolparam" {
+						name    = "boolparam"
+						type    = "bool"
+						default = true
+					}
+					data "coder_parameter" "listparam" {
+						name    = "listparam"
+						type    = "list(string)"
+						default = "[\"a\", \"b\"]"
+					}
+					data "coder_workspace_tags" "tags" {
+						tags = {
+							"stringvar"   = var.stringvar
+							"numvar"      = var.numvar
+							"boolvar"     = var.boolvar
+							"listvar"     = var.listvar
+							"mapvar"      = var.mapvar
+							"stringparam" = data.coder_parameter.stringparam.value
+							"numparam"    = data.coder_parameter.numparam.value
+							"boolparam"   = data.coder_parameter.boolparam.value
+							"listparam"   = data.coder_parameter.listparam.value
+						}
+					}`,
+			},
+			expectTags: map[string]string{
+				"stringvar":   "a",
+				"numvar":      "1",
+				"boolvar":     "true",
+				"stringparam": "a",
+				"numparam":    "1",
+				"boolparam":   "true",
+				"listparam":   `["a", "b"]`, // OK because params are cast to strings
+			},
+			expectedFailedTags: map[string]string{
+				"listvar": invalidValueType,
+				"mapvar":  invalidValueType,
+			},
+		},
+		{
+			name: "overlapping var name",
+			files: map[string]string{
+				`main.tf`: `
+				variable "a" {
+					type = string
+					default = "1"
+				}
+				variable "unused" {
+					type = map(string)
+					default = {"a" : "b"}
+				}
+				variable "ab" {
+					description = "This is a variable of type string"
+					type        = string
+					default     = "ab"
+				}
+				data "coder_workspace_tags" "tags" {
+					tags = {
+						"foo": "bar",
+						"a": var.a,
+					}
+				}`,
+			},
+			expectTags: map[string]string{"foo": "bar", "a": "1"},
+		},
+	} {
+		t.Run(tc.name+"/tar", func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitShort)
+			tarData := testutil.CreateTar(t, tc.files)
+
+			output, diags := preview.Preview(ctx, preview.Input{}, archivefs.FromTarReader(bytes.NewBuffer(tarData)))
+			if tc.expectedError != "" {
+				require.True(t, diags.HasErrors())
+				require.Contains(t, diags.Error(), tc.expectedError)
+				return
+			}
+			require.False(t, diags.HasErrors(), diags.Error())
+
+			tags := output.WorkspaceTags
+			tagMap := tags.Tags()
+			failedTags := tags.UnusableTags()
+			assert.Equal(t, tc.expectTags, tagMap, "expected tags to match, must always provide something")
+			for _, tag := range failedTags {
+				verr := failedTagDiagnostic(tag)
+				expectedErr, ok := tc.expectedFailedTags[tag.KeyString()]
+				require.Truef(t, ok, "assertion for failed tag required: %s, %s", tag.KeyString(), verr.Error())
+				assert.Contains(t, verr.Error(), expectedErr, tag.KeyString())
+			}
+		})
+
+		t.Run(tc.name+"/zip", func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitShort)
+			zipData := testutil.CreateZip(t, tc.files)
+
+			// get the zip fs
+			r, err := zip.NewReader(bytes.NewReader(zipData), int64(len(zipData)))
+			require.NoError(t, err)
+
+			output, diags := preview.Preview(ctx, preview.Input{}, afero.NewIOFS(zipfs.New(r)))
+			if tc.expectedError != "" {
+				require.True(t, diags.HasErrors())
+				require.Contains(t, diags.Error(), tc.expectedError)
+				return
+			}
+			require.False(t, diags.HasErrors(), diags.Error())
+
+			tags := output.WorkspaceTags
+			tagMap := tags.Tags()
+			failedTags := tags.UnusableTags()
+			assert.Equal(t, tc.expectTags, tagMap, "expected tags to match, must always provide something")
+			for _, tag := range failedTags {
+				verr := failedTagDiagnostic(tag)
+				expectedErr, ok := tc.expectedFailedTags[tag.KeyString()]
+				assert.Truef(t, ok, "assertion for failed tag required: %s, %s", tag.KeyString(), verr.Error())
+				assert.Contains(t, verr.Error(), expectedErr)
+			}
+		})
+	}
+}
diff --git a/coderd/httpmw/experiments.go b/coderd/httpmw/experiments.go
index 7c802725b91e6..7884443c1d011 100644
--- a/coderd/httpmw/experiments.go
+++ b/coderd/httpmw/experiments.go
@@ -3,21 +3,59 @@ package httpmw
 import (
 	"fmt"
 	"net/http"
+	"strings"
 
+	"github.com/coder/coder/v2/buildinfo"
 	"github.com/coder/coder/v2/coderd/httpapi"
 	"github.com/coder/coder/v2/codersdk"
 )
 
-func RequireExperiment(experiments codersdk.Experiments, experiment codersdk.Experiment) func(next http.Handler) http.Handler {
+// RequireExperiment returns middleware that checks if all required experiments are enabled.
+// If any experiment is disabled, it returns a 403 Forbidden response with details about the missing experiments.
+func RequireExperiment(experiments codersdk.Experiments, requiredExperiments ...codersdk.Experiment) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if !experiments.Enabled(experiment) {
-				httpapi.Write(r.Context(), w, http.StatusForbidden, codersdk.Response{
-					Message: fmt.Sprintf("Experiment '%s' is required but not enabled", experiment),
-				})
-				return
+			for _, experiment := range requiredExperiments {
+				if !experiments.Enabled(experiment) {
+					var experimentNames []string
+					for _, exp := range requiredExperiments {
+						experimentNames = append(experimentNames, string(exp))
+					}
+
+					// Print a message that includes the experiment names
+					// even if some experiments are already enabled.
+					var message string
+					if len(requiredExperiments) == 1 {
+						message = fmt.Sprintf("%s functionality requires enabling the '%s' experiment.",
+							requiredExperiments[0].DisplayName(), requiredExperiments[0])
+					} else {
+						message = fmt.Sprintf("This functionality requires enabling the following experiments: %s",
+							strings.Join(experimentNames, ", "))
+					}
+
+					httpapi.Write(r.Context(), w, http.StatusForbidden, codersdk.Response{
+						Message: message,
+					})
+					return
+				}
 			}
+
 			next.ServeHTTP(w, r)
 		})
 	}
 }
+
+// RequireExperimentWithDevBypass checks if ALL the given experiments are enabled,
+// but bypasses the check in development mode (buildinfo.IsDev()).
+func RequireExperimentWithDevBypass(experiments codersdk.Experiments, requiredExperiments ...codersdk.Experiment) func(next http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if buildinfo.IsDev() {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			RequireExperiment(experiments, requiredExperiments...)(next).ServeHTTP(w, r)
+		})
+	}
+}
diff --git a/coderd/mcp/mcp.go b/coderd/mcp/mcp.go
new file mode 100644
index 0000000000000..84cbfdda2cd9f
--- /dev/null
+++ b/coderd/mcp/mcp.go
@@ -0,0 +1,135 @@
+package mcp
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/mark3labs/mcp-go/server"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/toolsdk"
+)
+
+const (
+	// MCPServerName is the name used for the MCP server.
+	MCPServerName = "Coder"
+	// MCPServerInstructions is the instructions text for the MCP server.
+	MCPServerInstructions = "Coder MCP Server providing workspace and template management tools"
+)
+
+// Server represents an MCP HTTP server instance
+type Server struct {
+	Logger slog.Logger
+
+	// mcpServer is the underlying MCP server
+	mcpServer *server.MCPServer
+
+	// streamableServer handles HTTP transport
+	streamableServer *server.StreamableHTTPServer
+}
+
+// NewServer creates a new MCP HTTP server
+func NewServer(logger slog.Logger) (*Server, error) {
+	// Create the core MCP server
+	mcpSrv := server.NewMCPServer(
+		MCPServerName,
+		buildinfo.Version(),
+		server.WithInstructions(MCPServerInstructions),
+	)
+
+	// Create logger adapter for mcp-go
+	mcpLogger := &mcpLoggerAdapter{logger: logger}
+
+	// Create streamable HTTP server with configuration
+	streamableServer := server.NewStreamableHTTPServer(mcpSrv,
+		server.WithHeartbeatInterval(30*time.Second),
+		server.WithLogger(mcpLogger),
+	)
+
+	return &Server{
+		Logger:           logger,
+		mcpServer:        mcpSrv,
+		streamableServer: streamableServer,
+	}, nil
+}
+
+// ServeHTTP implements http.Handler interface
+func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	s.streamableServer.ServeHTTP(w, r)
+}
+
+// RegisterTools registers all available MCP tools with the server
+func (s *Server) RegisterTools(client *codersdk.Client) error {
+	if client == nil {
+		return xerrors.New("client cannot be nil: MCP HTTP server requires authenticated client")
+	}
+
+	// Create tool dependencies
+	toolDeps, err := toolsdk.NewDeps(client)
+	if err != nil {
+		return xerrors.Errorf("failed to initialize tool dependencies: %w", err)
+	}
+
+	// Register all available tools
+	for _, tool := range toolsdk.All {
+		s.mcpServer.AddTools(mcpFromSDK(tool, toolDeps))
+	}
+
+	return nil
+}
+
+// mcpFromSDK adapts a toolsdk.Tool to go-mcp's server.ServerTool
+func mcpFromSDK(sdkTool toolsdk.GenericTool, tb toolsdk.Deps) server.ServerTool {
+	if sdkTool.Schema.Properties == nil {
+		panic("developer error: schema properties cannot be nil")
+	}
+
+	return server.ServerTool{
+		Tool: mcp.Tool{
+			Name:        sdkTool.Name,
+			Description: sdkTool.Description,
+			InputSchema: mcp.ToolInputSchema{
+				Type:       "object",
+				Properties: sdkTool.Schema.Properties,
+				Required:   sdkTool.Schema.Required,
+			},
+		},
+		Handler: func(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+			var buf bytes.Buffer
+			if err := json.NewEncoder(&buf).Encode(request.Params.Arguments); err != nil {
+				return nil, xerrors.Errorf("failed to encode request arguments: %w", err)
+			}
+			result, err := sdkTool.Handler(ctx, tb, buf.Bytes())
+			if err != nil {
+				return nil, err
+			}
+			return &mcp.CallToolResult{
+				Content: []mcp.Content{
+					mcp.NewTextContent(string(result)),
+				},
+			}, nil
+		},
+	}
+}
+
+// mcpLoggerAdapter adapts slog.Logger to the mcp-go util.Logger interface
+type mcpLoggerAdapter struct {
+	logger slog.Logger
+}
+
+func (l *mcpLoggerAdapter) Infof(format string, v ...any) {
+	l.logger.Info(context.Background(), fmt.Sprintf(format, v...))
+}
+
+func (l *mcpLoggerAdapter) Errorf(format string, v ...any) {
+	l.logger.Error(context.Background(), fmt.Sprintf(format, v...))
+}
diff --git a/coderd/mcp/mcp_e2e_test.go b/coderd/mcp/mcp_e2e_test.go
new file mode 100644
index 0000000000000..248786405fda9
--- /dev/null
+++ b/coderd/mcp/mcp_e2e_test.go
@@ -0,0 +1,1223 @@
+package mcp_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+
+	mcpclient "github.com/mark3labs/mcp-go/client"
+	"github.com/mark3labs/mcp-go/client/transport"
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	mcpserver "github.com/coder/coder/v2/coderd/mcp"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/toolsdk"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestMCPHTTP_E2E_ClientIntegration(t *testing.T) {
+	t.Parallel()
+
+	// Setup Coder server with authentication
+	coderClient, closer, api := coderdtest.NewWithAPI(t, nil)
+	defer closer.Close()
+
+	_ = coderdtest.CreateFirstUser(t, coderClient)
+
+	// Create MCP client pointing to our endpoint
+	mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http"
+
+	// Configure client with authentication headers using RFC 6750 Bearer token
+	mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL,
+		transport.WithHTTPHeaders(map[string]string{
+			"Authorization": "Bearer " + coderClient.SessionToken(),
+		}))
+	require.NoError(t, err)
+	defer func() {
+		if closeErr := mcpClient.Close(); closeErr != nil {
+			t.Logf("Failed to close MCP client: %v", closeErr)
+		}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	// Start client
+	err = mcpClient.Start(ctx)
+	require.NoError(t, err)
+
+	// Initialize connection
+	initReq := mcp.InitializeRequest{
+		Params: mcp.InitializeParams{
+			ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
+			ClientInfo: mcp.Implementation{
+				Name:    "test-client",
+				Version: "1.0.0",
+			},
+		},
+	}
+
+	result, err := mcpClient.Initialize(ctx, initReq)
+	require.NoError(t, err)
+	require.Equal(t, mcpserver.MCPServerName, result.ServerInfo.Name)
+	require.Equal(t, mcp.LATEST_PROTOCOL_VERSION, result.ProtocolVersion)
+	require.NotNil(t, result.Capabilities)
+
+	// Test tool listing
+	tools, err := mcpClient.ListTools(ctx, mcp.ListToolsRequest{})
+	require.NoError(t, err)
+	require.NotEmpty(t, tools.Tools)
+
+	// Verify we have some expected Coder tools
+	var foundTools []string
+	for _, tool := range tools.Tools {
+		foundTools = append(foundTools, tool.Name)
+	}
+
+	// Check for some basic tools that should be available
+	assert.Contains(t, foundTools, toolsdk.ToolNameGetAuthenticatedUser, "Should have authenticated user tool")
+
+	// Find and execute the authenticated user tool
+	var userTool *mcp.Tool
+	for _, tool := range tools.Tools {
+		if tool.Name == toolsdk.ToolNameGetAuthenticatedUser {
+			userTool = &tool
+			break
+		}
+	}
+	require.NotNil(t, userTool, "Expected to find "+toolsdk.ToolNameGetAuthenticatedUser+" tool")
+
+	// Execute the tool
+	toolReq := mcp.CallToolRequest{
+		Params: mcp.CallToolParams{
+			Name:      userTool.Name,
+			Arguments: map[string]any{},
+		},
+	}
+
+	toolResult, err := mcpClient.CallTool(ctx, toolReq)
+	require.NoError(t, err)
+	require.NotEmpty(t, toolResult.Content)
+
+	// Verify the result contains user information
+	assert.Len(t, toolResult.Content, 1)
+	if textContent, ok := toolResult.Content[0].(mcp.TextContent); ok {
+		assert.Equal(t, "text", textContent.Type)
+		assert.NotEmpty(t, textContent.Text)
+	} else {
+		t.Errorf("Expected TextContent type, got %T", toolResult.Content[0])
+	}
+
+	// Test ping functionality
+	err = mcpClient.Ping(ctx)
+	require.NoError(t, err)
+}
+
+func TestMCPHTTP_E2E_UnauthenticatedAccess(t *testing.T) {
+	t.Parallel()
+
+	// Setup Coder server
+	_, closer, api := coderdtest.NewWithAPI(t, nil)
+	defer closer.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	// Test direct HTTP request to verify 401 status code
+	mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http"
+
+	// Make a POST request without authentication (MCP over HTTP uses POST)
+	//nolint:gosec // Test code using controlled localhost URL
+	req, err := http.NewRequestWithContext(ctx, "POST", mcpURL, strings.NewReader(`{"jsonrpc":"2.0","method":"initialize","params":{},"id":1}`))
+	require.NoError(t, err, "Should be able to create HTTP request")
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err, "Should be able to make HTTP request")
+	defer resp.Body.Close()
+
+	// Verify we get 401 Unauthorized
+	require.Equal(t, http.StatusUnauthorized, resp.StatusCode, "Should get HTTP 401 for unauthenticated access")
+
+	// Also test with MCP client to ensure it handles the error gracefully
+	mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL)
+	require.NoError(t, err, "Should be able to create MCP client without authentication")
+	defer func() {
+		if closeErr := mcpClient.Close(); closeErr != nil {
+			t.Logf("Failed to close MCP client: %v", closeErr)
+		}
+	}()
+
+	// Start client and try to initialize - this should fail due to authentication
+	err = mcpClient.Start(ctx)
+	if err != nil {
+		// Authentication failed at transport level - this is expected
+		t.Logf("Unauthenticated access test successful: Transport-level authentication error: %v", err)
+		return
+	}
+
+	initReq := mcp.InitializeRequest{
+		Params: mcp.InitializeParams{
+			ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
+			ClientInfo: mcp.Implementation{
+				Name:    "test-client-unauth",
+				Version: "1.0.0",
+			},
+		},
+	}
+
+	_, err = mcpClient.Initialize(ctx, initReq)
+	require.Error(t, err, "Should fail during MCP initialization without authentication")
+}
+
+func TestMCPHTTP_E2E_ToolWithWorkspace(t *testing.T) {
+	t.Parallel()
+
+	// Setup Coder server with full workspace environment
+	coderClient, closer, api := coderdtest.NewWithAPI(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
+	})
+	defer closer.Close()
+
+	user := coderdtest.CreateFirstUser(t, coderClient)
+
+	// Create template and workspace for testing
+	version := coderdtest.CreateTemplateVersion(t, coderClient, user.OrganizationID, nil)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, coderClient, version.ID)
+	template := coderdtest.CreateTemplate(t, coderClient, user.OrganizationID, version.ID)
+	workspace := coderdtest.CreateWorkspace(t, coderClient, template.ID)
+
+	// Create MCP client
+	mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http"
+	mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL,
+		transport.WithHTTPHeaders(map[string]string{
+			"Authorization": "Bearer " + coderClient.SessionToken(),
+		}))
+	require.NoError(t, err)
+	defer func() {
+		if closeErr := mcpClient.Close(); closeErr != nil {
+			t.Logf("Failed to close MCP client: %v", closeErr)
+		}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	// Start and initialize client
+	err = mcpClient.Start(ctx)
+	require.NoError(t, err)
+
+	initReq := mcp.InitializeRequest{
+		Params: mcp.InitializeParams{
+			ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
+			ClientInfo: mcp.Implementation{
+				Name:    "test-client-workspace",
+				Version: "1.0.0",
+			},
+		},
+	}
+
+	_, err = mcpClient.Initialize(ctx, initReq)
+	require.NoError(t, err)
+
+	// Test workspace-related tools
+	tools, err := mcpClient.ListTools(ctx, mcp.ListToolsRequest{})
+	require.NoError(t, err)
+
+	// Find workspace listing tool
+	var workspaceTool *mcp.Tool
+	for _, tool := range tools.Tools {
+		if tool.Name == toolsdk.ToolNameListWorkspaces {
+			workspaceTool = &tool
+			break
+		}
+	}
+
+	if workspaceTool != nil {
+		// Execute workspace listing tool
+		toolReq := mcp.CallToolRequest{
+			Params: mcp.CallToolParams{
+				Name:      workspaceTool.Name,
+				Arguments: map[string]any{},
+			},
+		}
+
+		toolResult, err := mcpClient.CallTool(ctx, toolReq)
+		require.NoError(t, err)
+		require.NotEmpty(t, toolResult.Content)
+
+		// Verify the result mentions our workspace
+		if textContent, ok := toolResult.Content[0].(mcp.TextContent); ok {
+			assert.Contains(t, textContent.Text, workspace.Name, "Workspace listing should include our test workspace")
+		} else {
+			t.Error("Expected TextContent type from workspace tool")
+		}
+
+		t.Logf("Workspace tool test successful: Found workspace %s in results", workspace.Name)
+	} else {
+		t.Skip("Workspace listing tool not available, skipping workspace-specific test")
+	}
+}
+
+func TestMCPHTTP_E2E_ErrorHandling(t *testing.T) {
+	t.Parallel()
+
+	// Setup Coder server
+	coderClient, closer, api := coderdtest.NewWithAPI(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
+	})
+	defer closer.Close()
+
+	_ = coderdtest.CreateFirstUser(t, coderClient)
+
+	// Create MCP client
+	mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http"
+	mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL,
+		transport.WithHTTPHeaders(map[string]string{
+			"Authorization": "Bearer " + coderClient.SessionToken(),
+		}))
+	require.NoError(t, err)
+	defer func() {
+		if closeErr := mcpClient.Close(); closeErr != nil {
+			t.Logf("Failed to close MCP client: %v", closeErr)
+		}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	// Start and initialize client
+	err = mcpClient.Start(ctx)
+	require.NoError(t, err)
+
+	initReq := mcp.InitializeRequest{
+		Params: mcp.InitializeParams{
+			ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
+			ClientInfo: mcp.Implementation{
+				Name:    "test-client-errors",
+				Version: "1.0.0",
+			},
+		},
+	}
+
+	_, err = mcpClient.Initialize(ctx, initReq)
+	require.NoError(t, err)
+
+	// Test calling non-existent tool
+	toolReq := mcp.CallToolRequest{
+		Params: mcp.CallToolParams{
+			Name:      "nonexistent_tool",
+			Arguments: map[string]any{},
+		},
+	}
+
+	_, err = mcpClient.CallTool(ctx, toolReq)
+	require.Error(t, err, "Should get error when calling non-existent tool")
+	require.Contains(t, err.Error(), "nonexistent_tool", "Should mention the tool name in error message")
+
+	t.Logf("Error handling test successful: Got expected error for non-existent tool")
+}
+
+func TestMCPHTTP_E2E_ConcurrentRequests(t *testing.T) {
+	t.Parallel()
+
+	// Setup Coder server
+	coderClient, closer, api := coderdtest.NewWithAPI(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
+	})
+	defer closer.Close()
+
+	_ = coderdtest.CreateFirstUser(t, coderClient)
+
+	// Create MCP client
+	mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http"
+	mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL,
+		transport.WithHTTPHeaders(map[string]string{
+			"Authorization": "Bearer " + coderClient.SessionToken(),
+		}))
+	require.NoError(t, err)
+	defer func() {
+		if closeErr := mcpClient.Close(); closeErr != nil {
+			t.Logf("Failed to close MCP client: %v", closeErr)
+		}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	// Start and initialize client
+	err = mcpClient.Start(ctx)
+	require.NoError(t, err)
+
+	initReq := mcp.InitializeRequest{
+		Params: mcp.InitializeParams{
+			ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
+			ClientInfo: mcp.Implementation{
+				Name:    "test-client-concurrent",
+				Version: "1.0.0",
+			},
+		},
+	}
+
+	_, err = mcpClient.Initialize(ctx, initReq)
+	require.NoError(t, err)
+
+	// Test concurrent tool listings
+	const numConcurrent = 5
+	eg, egCtx := errgroup.WithContext(ctx)
+
+	for range numConcurrent {
+		eg.Go(func() error {
+			reqCtx, reqCancel := context.WithTimeout(egCtx, testutil.WaitLong)
+			defer reqCancel()
+
+			tools, err := mcpClient.ListTools(reqCtx, mcp.ListToolsRequest{})
+			if err != nil {
+				return err
+			}
+
+			if len(tools.Tools) == 0 {
+				return assert.AnError
+			}
+
+			return nil
+		})
+	}
+
+	// Wait for all concurrent requests to complete
+	err = eg.Wait()
+	require.NoError(t, err, "All concurrent requests should succeed")
+
+	t.Logf("Concurrent requests test successful: All %d requests completed successfully", numConcurrent)
+}
+
+func TestMCPHTTP_E2E_RFC6750_UnauthenticatedRequest(t *testing.T) {
+	t.Parallel()
+
+	// Setup Coder server
+	_, closer, api := coderdtest.NewWithAPI(t, nil)
+	defer closer.Close()
+
+	// Make a request without any authentication headers
+	req := &http.Request{
+		Method: "POST",
+		URL:    mustParseURL(t, api.AccessURL.String()+"/api/experimental/mcp/http"),
+		Header: make(http.Header),
+	}
+
+	client := &http.Client{}
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	// Should get 401 Unauthorized
+	require.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+
+	// RFC 6750 requires WWW-Authenticate header on 401 responses
+	wwwAuth := resp.Header.Get("WWW-Authenticate")
+	require.NotEmpty(t, wwwAuth, "RFC 6750 requires WWW-Authenticate header for 401 responses")
+	require.Contains(t, wwwAuth, "Bearer", "WWW-Authenticate header should indicate Bearer authentication")
+	require.Contains(t, wwwAuth, `realm="coder"`, "WWW-Authenticate header should include realm")
+
+	t.Logf("RFC 6750 WWW-Authenticate header test successful: %s", wwwAuth)
+}
+
+func TestMCPHTTP_E2E_OAuth2_EndToEnd(t *testing.T) {
+	t.Parallel()
+
+	// Setup Coder server with OAuth2 provider enabled
+	coderClient, closer, api := coderdtest.NewWithAPI(t, nil)
+	t.Cleanup(func() { closer.Close() })
+
+	_ = coderdtest.CreateFirstUser(t, coderClient)
+
+	ctx := t.Context()
+
+	// Create OAuth2 app (for demonstration that OAuth2 provider is working)
+	_, err := coderClient.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{
+		Name:        "test-mcp-app",
+		CallbackURL: "http://localhost:3000/callback",
+	})
+	require.NoError(t, err)
+
+	// Test 1: OAuth2 Token Endpoint Error Format
+	t.Run("OAuth2TokenEndpointErrorFormat", func(t *testing.T) {
+		t.Parallel()
+		// Test that the /oauth2/tokens endpoint responds with proper OAuth2 error format
+		// Note: The endpoint is /oauth2/tokens (plural), not /oauth2/token (singular)
+		req := &http.Request{
+			Method: "POST",
+			URL:    mustParseURL(t, api.AccessURL.String()+"/oauth2/tokens"),
+			Header: map[string][]string{
+				"Content-Type": {"application/x-www-form-urlencoded"},
+			},
+			Body: http.NoBody,
+		}
+
+		client := &http.Client{}
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+
+		// The OAuth2 token endpoint should return HTTP 400 for invalid requests
+		require.Equal(t, http.StatusBadRequest, resp.StatusCode)
+
+		// Read and verify the response is OAuth2-compliant JSON error format
+		bodyBytes, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+
+		t.Logf("OAuth2 tokens endpoint returned status: %d, body: %q", resp.StatusCode, string(bodyBytes))
+
+		// Should be valid JSON with OAuth2 error format
+		var errorResponse map[string]any
+		err = json.Unmarshal(bodyBytes, &errorResponse)
+		require.NoError(t, err, "Response should be valid JSON")
+
+		// Verify OAuth2 error format (RFC 6749 section 5.2)
+		require.NotEmpty(t, errorResponse["error"], "Error field should not be empty")
+	})
+
+	// Test 2: MCP with OAuth2 Bearer Token
+	t.Run("MCPWithOAuth2BearerToken", func(t *testing.T) {
+		t.Parallel()
+		// For this test, we'll use the user's regular session token formatted as a Bearer token
+		// In a real OAuth2 flow, this would be an OAuth2 access token
+		sessionToken := coderClient.SessionToken()
+
+		mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http"
+		mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL,
+			transport.WithHTTPHeaders(map[string]string{
+				"Authorization": "Bearer " + sessionToken,
+			}))
+		require.NoError(t, err)
+		defer func() {
+			if closeErr := mcpClient.Close(); closeErr != nil {
+				t.Logf("Failed to close MCP client: %v", closeErr)
+			}
+		}()
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		// Start and initialize MCP client with Bearer token
+		err = mcpClient.Start(ctx)
+		require.NoError(t, err)
+
+		initReq := mcp.InitializeRequest{
+			Params: mcp.InitializeParams{
+				ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
+				ClientInfo: mcp.Implementation{
+					Name:    "test-oauth2-client",
+					Version: "1.0.0",
+				},
+			},
+		}
+
+		result, err := mcpClient.Initialize(ctx, initReq)
+		require.NoError(t, err)
+		require.Equal(t, mcpserver.MCPServerName, result.ServerInfo.Name)
+
+		// Test tool listing with OAuth2 Bearer token
+		tools, err := mcpClient.ListTools(ctx, mcp.ListToolsRequest{})
+		require.NoError(t, err)
+		require.NotEmpty(t, tools.Tools)
+
+		t.Logf("OAuth2 Bearer token MCP test successful: Found %d tools", len(tools.Tools))
+	})
+
+	// Test 3: Full OAuth2 Authorization Code Flow with Token Refresh
+	t.Run("OAuth2FullFlowWithTokenRefresh", func(t *testing.T) {
+		t.Parallel()
+		// Create an OAuth2 app specifically for this test
+		app, err := coderClient.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{
+			Name:        "test-oauth2-flow-app",
+			CallbackURL: "http://localhost:3000/callback",
+		})
+		require.NoError(t, err)
+
+		// Create a client secret for the app
+		secret, err := coderClient.PostOAuth2ProviderAppSecret(ctx, app.ID)
+		require.NoError(t, err)
+
+		// Step 1: Simulate authorization code flow by creating an authorization code
+		// In a real flow, this would be done through the browser consent page
+		// For testing, we'll create the code directly using the internal API
+
+		// First, we need to authorize the app (simulating user consent)
+		authURL := fmt.Sprintf("%s/oauth2/authorize?client_id=%s&response_type=code&redirect_uri=%s&state=test_state",
+			api.AccessURL.String(), app.ID, "http://localhost:3000/callback")
+
+		// Create an HTTP client that follows redirects but captures the final redirect
+		client := &http.Client{
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				return http.ErrUseLastResponse // Stop following redirects
+			},
+		}
+
+		// Make the authorization request (this would normally be done in a browser)
+		req, err := http.NewRequestWithContext(ctx, "GET", authURL, nil)
+		require.NoError(t, err)
+		// Use RFC 6750 Bearer token for authentication
+		req.Header.Set("Authorization", "Bearer "+coderClient.SessionToken())
+
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+
+		// The response should be a redirect to the consent page or directly to callback
+		// For testing purposes, let's simulate the POST consent approval
+		if resp.StatusCode == http.StatusOK {
+			// This means we got the consent page, now we need to POST consent
+			consentReq, err := http.NewRequestWithContext(ctx, "POST", authURL, nil)
+			require.NoError(t, err)
+			consentReq.Header.Set("Authorization", "Bearer "+coderClient.SessionToken())
+			consentReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+			resp, err = client.Do(consentReq)
+			require.NoError(t, err)
+			defer resp.Body.Close()
+		}
+
+		// Extract authorization code from redirect URL
+		require.True(t, resp.StatusCode >= 300 && resp.StatusCode < 400, "Expected redirect response")
+		location := resp.Header.Get("Location")
+		require.NotEmpty(t, location, "Expected Location header in redirect")
+
+		redirectURL, err := url.Parse(location)
+		require.NoError(t, err)
+		authCode := redirectURL.Query().Get("code")
+		require.NotEmpty(t, authCode, "Expected authorization code in redirect URL")
+
+		t.Logf("Successfully obtained authorization code: %s", authCode[:10]+"...")
+
+		// Step 2: Exchange authorization code for access token and refresh token
+		tokenRequestBody := url.Values{
+			"grant_type":    {"authorization_code"},
+			"client_id":     {app.ID.String()},
+			"client_secret": {secret.ClientSecretFull},
+			"code":          {authCode},
+			"redirect_uri":  {"http://localhost:3000/callback"},
+		}
+
+		tokenReq, err := http.NewRequestWithContext(ctx, "POST", api.AccessURL.String()+"/oauth2/tokens",
+			strings.NewReader(tokenRequestBody.Encode()))
+		require.NoError(t, err)
+		tokenReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+		tokenResp, err := http.DefaultClient.Do(tokenReq)
+		require.NoError(t, err)
+		defer tokenResp.Body.Close()
+
+		require.Equal(t, http.StatusOK, tokenResp.StatusCode, "Token exchange should succeed")
+
+		// Parse token response
+		var tokenResponse map[string]any
+		err = json.NewDecoder(tokenResp.Body).Decode(&tokenResponse)
+		require.NoError(t, err)
+
+		accessToken, ok := tokenResponse["access_token"].(string)
+		require.True(t, ok, "Response should contain access_token")
+		require.NotEmpty(t, accessToken)
+
+		refreshToken, ok := tokenResponse["refresh_token"].(string)
+		require.True(t, ok, "Response should contain refresh_token")
+		require.NotEmpty(t, refreshToken)
+
+		tokenType, ok := tokenResponse["token_type"].(string)
+		require.True(t, ok, "Response should contain token_type")
+		require.Equal(t, "Bearer", tokenType)
+
+		t.Logf("Successfully obtained access token: %s...", accessToken[:10])
+		t.Logf("Successfully obtained refresh token: %s...", refreshToken[:10])
+
+		// Step 3: Use access token to authenticate with MCP endpoint
+		mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http"
+		mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL,
+			transport.WithHTTPHeaders(map[string]string{
+				"Authorization": "Bearer " + accessToken,
+			}))
+		require.NoError(t, err)
+		defer func() {
+			if closeErr := mcpClient.Close(); closeErr != nil {
+				t.Logf("Failed to close MCP client: %v", closeErr)
+			}
+		}()
+
+		// Initialize and test the MCP connection with OAuth2 access token
+		err = mcpClient.Start(ctx)
+		require.NoError(t, err)
+
+		initReq := mcp.InitializeRequest{
+			Params: mcp.InitializeParams{
+				ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
+				ClientInfo: mcp.Implementation{
+					Name:    "test-oauth2-flow-client",
+					Version: "1.0.0",
+				},
+			},
+		}
+
+		result, err := mcpClient.Initialize(ctx, initReq)
+		require.NoError(t, err)
+		require.Equal(t, mcpserver.MCPServerName, result.ServerInfo.Name)
+
+		// Test tool execution with OAuth2 access token
+		tools, err := mcpClient.ListTools(ctx, mcp.ListToolsRequest{})
+		require.NoError(t, err)
+		require.NotEmpty(t, tools.Tools)
+
+		// Find and execute the authenticated user tool
+		var userTool *mcp.Tool
+		for _, tool := range tools.Tools {
+			if tool.Name == toolsdk.ToolNameGetAuthenticatedUser {
+				userTool = &tool
+				break
+			}
+		}
+		require.NotNil(t, userTool, "Expected to find "+toolsdk.ToolNameGetAuthenticatedUser+" tool")
+
+		toolReq := mcp.CallToolRequest{
+			Params: mcp.CallToolParams{
+				Name:      userTool.Name,
+				Arguments: map[string]any{},
+			},
+		}
+
+		toolResult, err := mcpClient.CallTool(ctx, toolReq)
+		require.NoError(t, err)
+		require.NotEmpty(t, toolResult.Content)
+
+		t.Logf("Successfully executed tool with OAuth2 access token")
+
+		// Step 4: Refresh the access token using refresh token
+		refreshRequestBody := url.Values{
+			"grant_type":    {"refresh_token"},
+			"client_id":     {app.ID.String()},
+			"client_secret": {secret.ClientSecretFull},
+			"refresh_token": {refreshToken},
+		}
+
+		refreshReq, err := http.NewRequestWithContext(ctx, "POST", api.AccessURL.String()+"/oauth2/tokens",
+			strings.NewReader(refreshRequestBody.Encode()))
+		require.NoError(t, err)
+		refreshReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+		refreshResp, err := http.DefaultClient.Do(refreshReq)
+		require.NoError(t, err)
+		defer refreshResp.Body.Close()
+
+		require.Equal(t, http.StatusOK, refreshResp.StatusCode, "Token refresh should succeed")
+
+		// Parse refresh response
+		var refreshResponse map[string]any
+		err = json.NewDecoder(refreshResp.Body).Decode(&refreshResponse)
+		require.NoError(t, err)
+
+		newAccessToken, ok := refreshResponse["access_token"].(string)
+		require.True(t, ok, "Refresh response should contain new access_token")
+		require.NotEmpty(t, newAccessToken)
+		require.NotEqual(t, accessToken, newAccessToken, "New access token should be different")
+
+		newRefreshToken, ok := refreshResponse["refresh_token"].(string)
+		require.True(t, ok, "Refresh response should contain new refresh_token")
+		require.NotEmpty(t, newRefreshToken)
+
+		t.Logf("Successfully refreshed token: %s...", newAccessToken[:10])
+
+		// Step 5: Use new access token to create another MCP connection
+		newMcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL,
+			transport.WithHTTPHeaders(map[string]string{
+				"Authorization": "Bearer " + newAccessToken,
+			}))
+		require.NoError(t, err)
+		defer func() {
+			if closeErr := newMcpClient.Close(); closeErr != nil {
+				t.Logf("Failed to close new MCP client: %v", closeErr)
+			}
+		}()
+
+		// Test the new token works
+		err = newMcpClient.Start(ctx)
+		require.NoError(t, err)
+
+		newInitReq := mcp.InitializeRequest{
+			Params: mcp.InitializeParams{
+				ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
+				ClientInfo: mcp.Implementation{
+					Name:    "test-refreshed-token-client",
+					Version: "1.0.0",
+				},
+			},
+		}
+
+		newResult, err := newMcpClient.Initialize(ctx, newInitReq)
+		require.NoError(t, err)
+		require.Equal(t, mcpserver.MCPServerName, newResult.ServerInfo.Name)
+
+		// Verify we can still execute tools with the refreshed token
+		newTools, err := newMcpClient.ListTools(ctx, mcp.ListToolsRequest{})
+		require.NoError(t, err)
+		require.NotEmpty(t, newTools.Tools)
+
+		t.Logf("OAuth2 full flow test successful: app creation -> authorization -> token exchange -> MCP usage -> token refresh -> MCP usage with refreshed token")
+	})
+
+	// Test 4: Invalid Bearer Token
+	t.Run("InvalidBearerToken", func(t *testing.T) {
+		t.Parallel()
+		req := &http.Request{
+			Method: "POST",
+			URL:    mustParseURL(t, api.AccessURL.String()+"/api/experimental/mcp/http"),
+			Header: map[string][]string{
+				"Authorization": {"Bearer invalid_token_value"},
+				"Content-Type":  {"application/json"},
+			},
+		}
+
+		client := &http.Client{}
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+
+		// Should get 401 Unauthorized
+		require.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+
+		// Should have RFC 6750 compliant WWW-Authenticate header
+		wwwAuth := resp.Header.Get("WWW-Authenticate")
+		require.NotEmpty(t, wwwAuth)
+		require.Contains(t, wwwAuth, "Bearer")
+		require.Contains(t, wwwAuth, `realm="coder"`)
+		require.Contains(t, wwwAuth, "invalid_token")
+
+		t.Logf("Invalid Bearer token test successful: %s", wwwAuth)
+	})
+
+	// Test 5: Dynamic Client Registration with Unauthenticated MCP Access
+	t.Run("DynamicClientRegistrationWithMCPFlow", func(t *testing.T) {
+		t.Parallel()
+		// Step 1: Attempt unauthenticated MCP access
+		mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http"
+		req := &http.Request{
+			Method: "POST",
+			URL:    mustParseURL(t, mcpURL),
+			Header: make(http.Header),
+		}
+
+		client := &http.Client{}
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+
+		// Should get 401 Unauthorized with WWW-Authenticate header
+		require.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+		wwwAuth := resp.Header.Get("WWW-Authenticate")
+		require.NotEmpty(t, wwwAuth, "RFC 6750 requires WWW-Authenticate header for 401 responses")
+		require.Contains(t, wwwAuth, "Bearer", "WWW-Authenticate header should indicate Bearer authentication")
+		require.Contains(t, wwwAuth, `realm="coder"`, "WWW-Authenticate header should include realm")
+
+		t.Logf("Unauthenticated MCP access properly returned WWW-Authenticate: %s", wwwAuth)
+
+		// Step 2: Perform dynamic client registration (RFC 7591)
+		dynamicRegURL := api.AccessURL.String() + "/oauth2/register"
+
+		// Create dynamic client registration request
+		registrationRequest := map[string]any{
+			"client_name":                "dynamic-mcp-client",
+			"redirect_uris":              []string{"http://localhost:3000/callback"},
+			"grant_types":                []string{"authorization_code", "refresh_token"},
+			"response_types":             []string{"code"},
+			"token_endpoint_auth_method": "client_secret_basic",
+		}
+
+		regBody, err := json.Marshal(registrationRequest)
+		require.NoError(t, err)
+
+		regReq, err := http.NewRequestWithContext(ctx, "POST", dynamicRegURL, strings.NewReader(string(regBody)))
+		require.NoError(t, err)
+		regReq.Header.Set("Content-Type", "application/json")
+
+		// Dynamic client registration should not require authentication (public endpoint)
+		regResp, err := http.DefaultClient.Do(regReq)
+		require.NoError(t, err)
+		defer regResp.Body.Close()
+
+		require.Equal(t, http.StatusCreated, regResp.StatusCode, "Dynamic client registration should succeed")
+
+		// Parse the registration response
+		var regResponse map[string]any
+		err = json.NewDecoder(regResp.Body).Decode(&regResponse)
+		require.NoError(t, err)
+
+		clientID, ok := regResponse["client_id"].(string)
+		require.True(t, ok, "Registration response should contain client_id")
+		require.NotEmpty(t, clientID)
+
+		clientSecret, ok := regResponse["client_secret"].(string)
+		require.True(t, ok, "Registration response should contain client_secret")
+		require.NotEmpty(t, clientSecret)
+
+		t.Logf("Successfully registered dynamic client: %s", clientID)
+
+		// Step 3: Perform OAuth2 authorization code flow with dynamically registered client
+		authURL := fmt.Sprintf("%s/oauth2/authorize?client_id=%s&response_type=code&redirect_uri=%s&state=dynamic_state",
+			api.AccessURL.String(), clientID, "http://localhost:3000/callback")
+
+		// Create an HTTP client that captures redirects
+		authClient := &http.Client{
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				return http.ErrUseLastResponse // Stop following redirects
+			},
+		}
+
+		// Make the authorization request with authentication
+		authReq, err := http.NewRequestWithContext(ctx, "GET", authURL, nil)
+		require.NoError(t, err)
+		authReq.Header.Set("Cookie", fmt.Sprintf("coder_session_token=%s", coderClient.SessionToken()))
+
+		authResp, err := authClient.Do(authReq)
+		require.NoError(t, err)
+		defer authResp.Body.Close()
+
+		// Handle the response - check for error first
+		if authResp.StatusCode == http.StatusBadRequest {
+			// Read error response for debugging
+			bodyBytes, err := io.ReadAll(authResp.Body)
+			require.NoError(t, err)
+			t.Logf("OAuth2 authorization error: %s", string(bodyBytes))
+			t.FailNow()
+		}
+
+		// Handle consent flow if needed
+		if authResp.StatusCode == http.StatusOK {
+			// This means we got the consent page, now we need to POST consent
+			consentReq, err := http.NewRequestWithContext(ctx, "POST", authURL, nil)
+			require.NoError(t, err)
+			consentReq.Header.Set("Cookie", fmt.Sprintf("coder_session_token=%s", coderClient.SessionToken()))
+			consentReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+			authResp, err = authClient.Do(consentReq)
+			require.NoError(t, err)
+			defer authResp.Body.Close()
+		}
+
+		// Extract authorization code from redirect
+		require.True(t, authResp.StatusCode >= 300 && authResp.StatusCode < 400,
+			"Expected redirect response, got %d", authResp.StatusCode)
+		location := authResp.Header.Get("Location")
+		require.NotEmpty(t, location, "Expected Location header in redirect")
+
+		redirectURL, err := url.Parse(location)
+		require.NoError(t, err)
+		authCode := redirectURL.Query().Get("code")
+		require.NotEmpty(t, authCode, "Expected authorization code in redirect URL")
+
+		t.Logf("Successfully obtained authorization code: %s", authCode[:10]+"...")
+
+		// Step 4: Exchange authorization code for access token
+		tokenRequestBody := url.Values{
+			"grant_type":    {"authorization_code"},
+			"client_id":     {clientID},
+			"client_secret": {clientSecret},
+			"code":          {authCode},
+			"redirect_uri":  {"http://localhost:3000/callback"},
+		}
+
+		tokenReq, err := http.NewRequestWithContext(ctx, "POST", api.AccessURL.String()+"/oauth2/tokens",
+			strings.NewReader(tokenRequestBody.Encode()))
+		require.NoError(t, err)
+		tokenReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+		tokenResp, err := http.DefaultClient.Do(tokenReq)
+		require.NoError(t, err)
+		defer tokenResp.Body.Close()
+
+		require.Equal(t, http.StatusOK, tokenResp.StatusCode, "Token exchange should succeed")
+
+		// Parse token response
+		var tokenResponse map[string]any
+		err = json.NewDecoder(tokenResp.Body).Decode(&tokenResponse)
+		require.NoError(t, err)
+
+		accessToken, ok := tokenResponse["access_token"].(string)
+		require.True(t, ok, "Response should contain access_token")
+		require.NotEmpty(t, accessToken)
+
+		refreshToken, ok := tokenResponse["refresh_token"].(string)
+		require.True(t, ok, "Response should contain refresh_token")
+		require.NotEmpty(t, refreshToken)
+
+		t.Logf("Successfully obtained access token: %s...", accessToken[:10])
+
+		// Step 5: Use access token to get user information via MCP
+		mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL,
+			transport.WithHTTPHeaders(map[string]string{
+				"Authorization": "Bearer " + accessToken,
+			}))
+		require.NoError(t, err)
+		defer func() {
+			if closeErr := mcpClient.Close(); closeErr != nil {
+				t.Logf("Failed to close MCP client: %v", closeErr)
+			}
+		}()
+
+		// Initialize MCP connection
+		err = mcpClient.Start(ctx)
+		require.NoError(t, err)
+
+		initReq := mcp.InitializeRequest{
+			Params: mcp.InitializeParams{
+				ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
+				ClientInfo: mcp.Implementation{
+					Name:    "test-dynamic-client",
+					Version: "1.0.0",
+				},
+			},
+		}
+
+		result, err := mcpClient.Initialize(ctx, initReq)
+		require.NoError(t, err)
+		require.Equal(t, mcpserver.MCPServerName, result.ServerInfo.Name)
+
+		// Get user information
+		tools, err := mcpClient.ListTools(ctx, mcp.ListToolsRequest{})
+		require.NoError(t, err)
+		require.NotEmpty(t, tools.Tools)
+
+		// Find and execute the authenticated user tool
+		var userTool *mcp.Tool
+		for _, tool := range tools.Tools {
+			if tool.Name == toolsdk.ToolNameGetAuthenticatedUser {
+				userTool = &tool
+				break
+			}
+		}
+		require.NotNil(t, userTool, "Expected to find "+toolsdk.ToolNameGetAuthenticatedUser+" tool")
+
+		toolReq := mcp.CallToolRequest{
+			Params: mcp.CallToolParams{
+				Name:      userTool.Name,
+				Arguments: map[string]any{},
+			},
+		}
+
+		toolResult, err := mcpClient.CallTool(ctx, toolReq)
+		require.NoError(t, err)
+		require.NotEmpty(t, toolResult.Content)
+
+		// Extract user info from first token
+		var firstUserInfo string
+		if textContent, ok := toolResult.Content[0].(mcp.TextContent); ok {
+			firstUserInfo = textContent.Text
+		} else {
+			t.Errorf("Expected TextContent type, got %T", toolResult.Content[0])
+		}
+		require.NotEmpty(t, firstUserInfo)
+
+		t.Logf("Successfully retrieved user info with first token")
+
+		// Step 6: Refresh the token
+		refreshRequestBody := url.Values{
+			"grant_type":    {"refresh_token"},
+			"client_id":     {clientID},
+			"client_secret": {clientSecret},
+			"refresh_token": {refreshToken},
+		}
+
+		refreshReq, err := http.NewRequestWithContext(ctx, "POST", api.AccessURL.String()+"/oauth2/tokens",
+			strings.NewReader(refreshRequestBody.Encode()))
+		require.NoError(t, err)
+		refreshReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+		refreshResp, err := http.DefaultClient.Do(refreshReq)
+		require.NoError(t, err)
+		defer refreshResp.Body.Close()
+
+		require.Equal(t, http.StatusOK, refreshResp.StatusCode, "Token refresh should succeed")
+
+		// Parse refresh response
+		var refreshResponse map[string]any
+		err = json.NewDecoder(refreshResp.Body).Decode(&refreshResponse)
+		require.NoError(t, err)
+
+		newAccessToken, ok := refreshResponse["access_token"].(string)
+		require.True(t, ok, "Refresh response should contain new access_token")
+		require.NotEmpty(t, newAccessToken)
+		require.NotEqual(t, accessToken, newAccessToken, "New access token should be different")
+
+		t.Logf("Successfully refreshed token: %s...", newAccessToken[:10])
+
+		// Step 7: Use refreshed token to get user information again via MCP
+		newMcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL,
+			transport.WithHTTPHeaders(map[string]string{
+				"Authorization": "Bearer " + newAccessToken,
+			}))
+		require.NoError(t, err)
+		defer func() {
+			if closeErr := newMcpClient.Close(); closeErr != nil {
+				t.Logf("Failed to close new MCP client: %v", closeErr)
+			}
+		}()
+
+		// Initialize new MCP connection
+		err = newMcpClient.Start(ctx)
+		require.NoError(t, err)
+
+		newInitReq := mcp.InitializeRequest{
+			Params: mcp.InitializeParams{
+				ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
+				ClientInfo: mcp.Implementation{
+					Name:    "test-dynamic-client-refreshed",
+					Version: "1.0.0",
+				},
+			},
+		}
+
+		newResult, err := newMcpClient.Initialize(ctx, newInitReq)
+		require.NoError(t, err)
+		require.Equal(t, mcpserver.MCPServerName, newResult.ServerInfo.Name)
+
+		// Get user information with refreshed token
+		newTools, err := newMcpClient.ListTools(ctx, mcp.ListToolsRequest{})
+		require.NoError(t, err)
+		require.NotEmpty(t, newTools.Tools)
+
+		// Execute user tool again
+		newToolResult, err := newMcpClient.CallTool(ctx, toolReq)
+		require.NoError(t, err)
+		require.NotEmpty(t, newToolResult.Content)
+
+		// Extract user info from refreshed token
+		var secondUserInfo string
+		if textContent, ok := newToolResult.Content[0].(mcp.TextContent); ok {
+			secondUserInfo = textContent.Text
+		} else {
+			t.Errorf("Expected TextContent type, got %T", newToolResult.Content[0])
+		}
+		require.NotEmpty(t, secondUserInfo)
+
+		// Step 8: Compare user information before and after token refresh
+		// Parse JSON to compare the important fields, ignoring timestamp differences
+		var firstUser, secondUser map[string]any
+		err = json.Unmarshal([]byte(firstUserInfo), &firstUser)
+		require.NoError(t, err)
+		err = json.Unmarshal([]byte(secondUserInfo), &secondUser)
+		require.NoError(t, err)
+
+		// Compare key fields that should be identical
+		require.Equal(t, firstUser["id"], secondUser["id"], "User ID should be identical")
+		require.Equal(t, firstUser["username"], secondUser["username"], "Username should be identical")
+		require.Equal(t, firstUser["email"], secondUser["email"], "Email should be identical")
+		require.Equal(t, firstUser["status"], secondUser["status"], "Status should be identical")
+		require.Equal(t, firstUser["login_type"], secondUser["login_type"], "Login type should be identical")
+		require.Equal(t, firstUser["roles"], secondUser["roles"], "Roles should be identical")
+		require.Equal(t, firstUser["organization_ids"], secondUser["organization_ids"], "Organization IDs should be identical")
+
+		// Note: last_seen_at will be different since time passed between calls, which is expected
+
+		t.Logf("Dynamic client registration flow test successful: " +
+			"unauthenticated access → WWW-Authenticate → dynamic registration → OAuth2 flow → " +
+			"MCP usage → token refresh → MCP usage with consistent user info")
+	})
+
+	// Test 6: Verify duplicate client names are allowed (RFC 7591 compliance)
+	t.Run("DuplicateClientNamesAllowed", func(t *testing.T) {
+		t.Parallel()
+
+		dynamicRegURL := api.AccessURL.String() + "/oauth2/register"
+		clientName := "duplicate-name-test-client"
+
+		// Register first client with a specific name
+		registrationRequest1 := map[string]any{
+			"client_name":                clientName,
+			"redirect_uris":              []string{"http://localhost:3000/callback1"},
+			"grant_types":                []string{"authorization_code", "refresh_token"},
+			"response_types":             []string{"code"},
+			"token_endpoint_auth_method": "client_secret_basic",
+		}
+
+		regBody1, err := json.Marshal(registrationRequest1)
+		require.NoError(t, err)
+
+		regReq1, err := http.NewRequestWithContext(ctx, "POST", dynamicRegURL, strings.NewReader(string(regBody1)))
+		require.NoError(t, err)
+		regReq1.Header.Set("Content-Type", "application/json")
+
+		regResp1, err := http.DefaultClient.Do(regReq1)
+		require.NoError(t, err)
+		defer regResp1.Body.Close()
+
+		require.Equal(t, http.StatusCreated, regResp1.StatusCode, "First client registration should succeed")
+
+		var regResponse1 map[string]any
+		err = json.NewDecoder(regResp1.Body).Decode(&regResponse1)
+		require.NoError(t, err)
+
+		clientID1, ok := regResponse1["client_id"].(string)
+		require.True(t, ok, "First registration response should contain client_id")
+		require.NotEmpty(t, clientID1)
+
+		// Register second client with the same name
+		registrationRequest2 := map[string]any{
+			"client_name":                clientName, // Same name as first client
+			"redirect_uris":              []string{"http://localhost:3000/callback2"},
+			"grant_types":                []string{"authorization_code", "refresh_token"},
+			"response_types":             []string{"code"},
+			"token_endpoint_auth_method": "client_secret_basic",
+		}
+
+		regBody2, err := json.Marshal(registrationRequest2)
+		require.NoError(t, err)
+
+		regReq2, err := http.NewRequestWithContext(ctx, "POST", dynamicRegURL, strings.NewReader(string(regBody2)))
+		require.NoError(t, err)
+		regReq2.Header.Set("Content-Type", "application/json")
+
+		regResp2, err := http.DefaultClient.Do(regReq2)
+		require.NoError(t, err)
+		defer regResp2.Body.Close()
+
+		// This should succeed per RFC 7591 (no unique name requirement)
+		require.Equal(t, http.StatusCreated, regResp2.StatusCode,
+			"Second client registration with duplicate name should succeed (RFC 7591 compliance)")
+
+		var regResponse2 map[string]any
+		err = json.NewDecoder(regResp2.Body).Decode(&regResponse2)
+		require.NoError(t, err)
+
+		clientID2, ok := regResponse2["client_id"].(string)
+		require.True(t, ok, "Second registration response should contain client_id")
+		require.NotEmpty(t, clientID2)
+
+		// Verify client IDs are different even though names are the same
+		require.NotEqual(t, clientID1, clientID2, "Client IDs should be unique even with duplicate names")
+
+		// Verify both clients have the same name but unique IDs
+		name1, ok := regResponse1["client_name"].(string)
+		require.True(t, ok)
+		name2, ok := regResponse2["client_name"].(string)
+		require.True(t, ok)
+
+		require.Equal(t, clientName, name1, "First client should have the expected name")
+		require.Equal(t, clientName, name2, "Second client should have the same name")
+		require.Equal(t, name1, name2, "Both clients should have identical names")
+
+		t.Logf("Successfully registered two OAuth2 clients with duplicate name '%s' but unique IDs: %s, %s",
+			clientName, clientID1, clientID2)
+	})
+}
+
+// Helper function to parse URL safely in tests
+func mustParseURL(t *testing.T, rawURL string) *url.URL {
+	u, err := url.Parse(rawURL)
+	require.NoError(t, err, "Failed to parse URL %q", rawURL)
+	return u
+}
diff --git a/coderd/mcp/mcp_test.go b/coderd/mcp/mcp_test.go
new file mode 100644
index 0000000000000..0c53c899b9830
--- /dev/null
+++ b/coderd/mcp/mcp_test.go
@@ -0,0 +1,133 @@
+package mcp_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	mcpserver "github.com/coder/coder/v2/coderd/mcp"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/toolsdk"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestMCPServer_Creation(t *testing.T) {
+	t.Parallel()
+
+	logger := testutil.Logger(t)
+
+	server, err := mcpserver.NewServer(logger)
+	require.NoError(t, err)
+	require.NotNil(t, server)
+}
+
+func TestMCPServer_Handler(t *testing.T) {
+	t.Parallel()
+
+	logger := testutil.Logger(t)
+
+	server, err := mcpserver.NewServer(logger)
+	require.NoError(t, err)
+
+	// Test that server implements http.Handler interface
+	var handler http.Handler = server
+	require.NotNil(t, handler)
+}
+
+func TestMCPHTTP_InitializeRequest(t *testing.T) {
+	t.Parallel()
+
+	logger := testutil.Logger(t)
+
+	server, err := mcpserver.NewServer(logger)
+	require.NoError(t, err)
+
+	// Use server directly as http.Handler
+	handler := server
+
+	// Create initialize request
+	initRequest := map[string]any{
+		"jsonrpc": "2.0",
+		"id":      1,
+		"method":  "initialize",
+		"params": map[string]any{
+			"protocolVersion": mcp.LATEST_PROTOCOL_VERSION,
+			"capabilities":    map[string]any{},
+			"clientInfo": map[string]any{
+				"name":    "test-client",
+				"version": "1.0.0",
+			},
+		},
+	}
+
+	body, err := json.Marshal(initRequest)
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodPost, "/", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json,text/event-stream")
+
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, req)
+
+	if recorder.Code != http.StatusOK {
+		t.Logf("Response body: %s", recorder.Body.String())
+	}
+	assert.Equal(t, http.StatusOK, recorder.Code)
+
+	// Check that a session ID was returned
+	sessionID := recorder.Header().Get("Mcp-Session-Id")
+	assert.NotEmpty(t, sessionID)
+
+	// Parse response
+	var response map[string]any
+	err = json.Unmarshal(recorder.Body.Bytes(), &response)
+	require.NoError(t, err)
+
+	assert.Equal(t, "2.0", response["jsonrpc"])
+	assert.Equal(t, float64(1), response["id"])
+
+	result, ok := response["result"].(map[string]any)
+	require.True(t, ok)
+
+	assert.Equal(t, mcp.LATEST_PROTOCOL_VERSION, result["protocolVersion"])
+	assert.Contains(t, result, "capabilities")
+	assert.Contains(t, result, "serverInfo")
+}
+
+func TestMCPHTTP_ToolRegistration(t *testing.T) {
+	t.Parallel()
+
+	logger := testutil.Logger(t)
+
+	server, err := mcpserver.NewServer(logger)
+	require.NoError(t, err)
+
+	// Test registering tools with nil client should return error
+	err = server.RegisterTools(nil)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "client cannot be nil", "Should reject nil client with appropriate error message")
+
+	// Test registering tools with valid client should succeed
+	client := &codersdk.Client{}
+	err = server.RegisterTools(client)
+	require.NoError(t, err)
+
+	// Verify that all expected tools are available in the toolsdk
+	expectedToolCount := len(toolsdk.All)
+	require.Greater(t, expectedToolCount, 0, "Should have some tools available")
+
+	// Verify specific tools are present by checking tool names
+	toolNames := make([]string, len(toolsdk.All))
+	for i, tool := range toolsdk.All {
+		toolNames[i] = tool.Name
+	}
+	require.Contains(t, toolNames, toolsdk.ToolNameReportTask, "Should include ReportTask (UserClientOptional)")
+	require.Contains(t, toolNames, toolsdk.ToolNameGetAuthenticatedUser, "Should include GetAuthenticatedUser (requires auth)")
+}
diff --git a/coderd/mcp_http.go b/coderd/mcp_http.go
new file mode 100644
index 0000000000000..40aaaa1c40dd5
--- /dev/null
+++ b/coderd/mcp_http.go
@@ -0,0 +1,39 @@
+package coderd
+
+import (
+	"net/http"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/mcp"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// mcpHTTPHandler creates the MCP HTTP transport handler
+func (api *API) mcpHTTPHandler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Create MCP server instance for each request
+		mcpServer, err := mcp.NewServer(api.Logger.Named("mcp"))
+		if err != nil {
+			api.Logger.Error(r.Context(), "failed to create MCP server", slog.Error(err))
+			httpapi.Write(r.Context(), w, http.StatusInternalServerError, codersdk.Response{
+				Message: "MCP server initialization failed",
+			})
+			return
+		}
+
+		authenticatedClient := codersdk.New(api.AccessURL)
+		// Extract the original session token from the request
+		authenticatedClient.SetSessionToken(httpmw.APITokenFromRequest(r))
+
+		// Register tools with authenticated client
+		if err := mcpServer.RegisterTools(authenticatedClient); err != nil {
+			api.Logger.Warn(r.Context(), "failed to register MCP tools", slog.Error(err))
+		}
+
+		// Handle the MCP request
+		mcpServer.ServeHTTP(w, r)
+	})
+}
diff --git a/coderd/notifications/utils_test.go b/coderd/notifications/utils_test.go
index d27093fb63119..ce071cc6a0a53 100644
--- a/coderd/notifications/utils_test.go
+++ b/coderd/notifications/utils_test.go
@@ -94,7 +94,6 @@ func (i *dispatchInterceptor) Dispatcher(payload types.MessagePayload, title, bo
 		}
 
 		retryable, err = deliveryFn(ctx, msgID)
-
 		if err != nil {
 			i.err.Add(1)
 			i.lastErr.Store(err)
diff --git a/coderd/oauth2.go b/coderd/oauth2.go
index a53513013a54b..9195876b9eebe 100644
--- a/coderd/oauth2.go
+++ b/coderd/oauth2.go
@@ -1,36 +1,11 @@
 package coderd
 
 import (
-	"database/sql"
-	"fmt"
 	"net/http"
 
-	"github.com/google/uuid"
-
-	"github.com/coder/coder/v2/buildinfo"
-	"github.com/coder/coder/v2/coderd/audit"
-	"github.com/coder/coder/v2/coderd/database"
-	"github.com/coder/coder/v2/coderd/database/db2sdk"
-	"github.com/coder/coder/v2/coderd/database/dbtime"
-	"github.com/coder/coder/v2/coderd/httpapi"
-	"github.com/coder/coder/v2/coderd/httpmw"
-	"github.com/coder/coder/v2/coderd/identityprovider"
-	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/coderd/oauth2provider"
 )
 
-func (*API) oAuth2ProviderMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
-		if !buildinfo.IsDev() {
-			httpapi.Write(r.Context(), rw, http.StatusForbidden, codersdk.Response{
-				Message: "OAuth2 provider is under development.",
-			})
-			return
-		}
-
-		next.ServeHTTP(rw, r)
-	})
-}
-
 // @Summary Get OAuth2 applications.
 // @ID get-oauth2-applications
 // @Security CoderSessionToken
@@ -39,40 +14,8 @@ func (*API) oAuth2ProviderMiddleware(next http.Handler) http.Handler {
 // @Param user_id query string false "Filter by applications authorized for a user"
 // @Success 200 {array} codersdk.OAuth2ProviderApp
 // @Router /oauth2-provider/apps [get]
-func (api *API) oAuth2ProviderApps(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-
-	rawUserID := r.URL.Query().Get("user_id")
-	if rawUserID == "" {
-		dbApps, err := api.Database.GetOAuth2ProviderApps(ctx)
-		if err != nil {
-			httpapi.InternalServerError(rw, err)
-			return
-		}
-		httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApps(api.AccessURL, dbApps))
-		return
-	}
-
-	userID, err := uuid.Parse(rawUserID)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "Invalid user UUID",
-			Detail:  fmt.Sprintf("queried user_id=%q", userID),
-		})
-		return
-	}
-
-	userApps, err := api.Database.GetOAuth2ProviderAppsByUserID(ctx, userID)
-	if err != nil {
-		httpapi.InternalServerError(rw, err)
-		return
-	}
-
-	var sdkApps []codersdk.OAuth2ProviderApp
-	for _, app := range userApps {
-		sdkApps = append(sdkApps, db2sdk.OAuth2ProviderApp(api.AccessURL, app.OAuth2ProviderApp))
-	}
-	httpapi.Write(ctx, rw, http.StatusOK, sdkApps)
+func (api *API) oAuth2ProviderApps() http.HandlerFunc {
+	return oauth2provider.ListApps(api.Database, api.AccessURL)
 }
 
 // @Summary Get OAuth2 application.
@@ -83,10 +26,8 @@ func (api *API) oAuth2ProviderApps(rw http.ResponseWriter, r *http.Request) {
 // @Param app path string true "App ID"
 // @Success 200 {object} codersdk.OAuth2ProviderApp
 // @Router /oauth2-provider/apps/{app} [get]
-func (api *API) oAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	app := httpmw.OAuth2ProviderApp(r)
-	httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApp(api.AccessURL, app))
+func (api *API) oAuth2ProviderApp() http.HandlerFunc {
+	return oauth2provider.GetApp(api.AccessURL)
 }
 
 // @Summary Create OAuth2 application.
@@ -98,48 +39,8 @@ func (api *API) oAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) {
 // @Param request body codersdk.PostOAuth2ProviderAppRequest true "The OAuth2 application to create."
 // @Success 200 {object} codersdk.OAuth2ProviderApp
 // @Router /oauth2-provider/apps [post]
-func (api *API) postOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) {
-	var (
-		ctx               = r.Context()
-		auditor           = api.Auditor.Load()
-		aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{
-			Audit:   *auditor,
-			Log:     api.Logger,
-			Request: r,
-			Action:  database.AuditActionCreate,
-		})
-	)
-	defer commitAudit()
-	var req codersdk.PostOAuth2ProviderAppRequest
-	if !httpapi.Read(ctx, rw, r, &req) {
-		return
-	}
-	app, err := api.Database.InsertOAuth2ProviderApp(ctx, database.InsertOAuth2ProviderAppParams{
-		ID:           uuid.New(),
-		CreatedAt:    dbtime.Now(),
-		UpdatedAt:    dbtime.Now(),
-		Name:         req.Name,
-		Icon:         req.Icon,
-		CallbackURL:  req.CallbackURL,
-		RedirectUris: []string{},
-		ClientType: sql.NullString{
-			String: "confidential",
-			Valid:  true,
-		},
-		DynamicallyRegistered: sql.NullBool{
-			Bool:  false,
-			Valid: true,
-		},
-	})
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error creating OAuth2 application.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-	aReq.New = app
-	httpapi.Write(ctx, rw, http.StatusCreated, db2sdk.OAuth2ProviderApp(api.AccessURL, app))
+func (api *API) postOAuth2ProviderApp() http.HandlerFunc {
+	return oauth2provider.CreateApp(api.Database, api.AccessURL, api.Auditor.Load(), api.Logger)
 }
 
 // @Summary Update OAuth2 application.
@@ -152,43 +53,8 @@ func (api *API) postOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) {
 // @Param request body codersdk.PutOAuth2ProviderAppRequest true "Update an OAuth2 application."
 // @Success 200 {object} codersdk.OAuth2ProviderApp
 // @Router /oauth2-provider/apps/{app} [put]
-func (api *API) putOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) {
-	var (
-		ctx               = r.Context()
-		app               = httpmw.OAuth2ProviderApp(r)
-		auditor           = api.Auditor.Load()
-		aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{
-			Audit:   *auditor,
-			Log:     api.Logger,
-			Request: r,
-			Action:  database.AuditActionWrite,
-		})
-	)
-	aReq.Old = app
-	defer commitAudit()
-	var req codersdk.PutOAuth2ProviderAppRequest
-	if !httpapi.Read(ctx, rw, r, &req) {
-		return
-	}
-	app, err := api.Database.UpdateOAuth2ProviderAppByID(ctx, database.UpdateOAuth2ProviderAppByIDParams{
-		ID:                    app.ID,
-		UpdatedAt:             dbtime.Now(),
-		Name:                  req.Name,
-		Icon:                  req.Icon,
-		CallbackURL:           req.CallbackURL,
-		RedirectUris:          app.RedirectUris,          // Keep existing value
-		ClientType:            app.ClientType,            // Keep existing value
-		DynamicallyRegistered: app.DynamicallyRegistered, // Keep existing value
-	})
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error updating OAuth2 application.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-	aReq.New = app
-	httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApp(api.AccessURL, app))
+func (api *API) putOAuth2ProviderApp() http.HandlerFunc {
+	return oauth2provider.UpdateApp(api.Database, api.AccessURL, api.Auditor.Load(), api.Logger)
 }
 
 // @Summary Delete OAuth2 application.
@@ -198,29 +64,8 @@ func (api *API) putOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) {
 // @Param app path string true "App ID"
 // @Success 204
 // @Router /oauth2-provider/apps/{app} [delete]
-func (api *API) deleteOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) {
-	var (
-		ctx               = r.Context()
-		app               = httpmw.OAuth2ProviderApp(r)
-		auditor           = api.Auditor.Load()
-		aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{
-			Audit:   *auditor,
-			Log:     api.Logger,
-			Request: r,
-			Action:  database.AuditActionDelete,
-		})
-	)
-	aReq.Old = app
-	defer commitAudit()
-	err := api.Database.DeleteOAuth2ProviderAppByID(ctx, app.ID)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error deleting OAuth2 application.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-	rw.WriteHeader(http.StatusNoContent)
+func (api *API) deleteOAuth2ProviderApp() http.HandlerFunc {
+	return oauth2provider.DeleteApp(api.Database, api.Auditor.Load(), api.Logger)
 }
 
 // @Summary Get OAuth2 application secrets.
@@ -231,26 +76,8 @@ func (api *API) deleteOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request)
 // @Param app path string true "App ID"
 // @Success 200 {array} codersdk.OAuth2ProviderAppSecret
 // @Router /oauth2-provider/apps/{app}/secrets [get]
-func (api *API) oAuth2ProviderAppSecrets(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	app := httpmw.OAuth2ProviderApp(r)
-	dbSecrets, err := api.Database.GetOAuth2ProviderAppSecretsByAppID(ctx, app.ID)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error getting OAuth2 client secrets.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-	secrets := []codersdk.OAuth2ProviderAppSecret{}
-	for _, secret := range dbSecrets {
-		secrets = append(secrets, codersdk.OAuth2ProviderAppSecret{
-			ID:                    secret.ID,
-			LastUsedAt:            codersdk.NullTime{NullTime: secret.LastUsedAt},
-			ClientSecretTruncated: secret.DisplaySecret,
-		})
-	}
-	httpapi.Write(ctx, rw, http.StatusOK, secrets)
+func (api *API) oAuth2ProviderAppSecrets() http.HandlerFunc {
+	return oauth2provider.GetAppSecrets(api.Database)
 }
 
 // @Summary Create OAuth2 application secret.
@@ -261,50 +88,8 @@ func (api *API) oAuth2ProviderAppSecrets(rw http.ResponseWriter, r *http.Request
 // @Param app path string true "App ID"
 // @Success 200 {array} codersdk.OAuth2ProviderAppSecretFull
 // @Router /oauth2-provider/apps/{app}/secrets [post]
-func (api *API) postOAuth2ProviderAppSecret(rw http.ResponseWriter, r *http.Request) {
-	var (
-		ctx               = r.Context()
-		app               = httpmw.OAuth2ProviderApp(r)
-		auditor           = api.Auditor.Load()
-		aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderAppSecret](rw, &audit.RequestParams{
-			Audit:   *auditor,
-			Log:     api.Logger,
-			Request: r,
-			Action:  database.AuditActionCreate,
-		})
-	)
-	defer commitAudit()
-	secret, err := identityprovider.GenerateSecret()
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Failed to generate OAuth2 client secret.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-	dbSecret, err := api.Database.InsertOAuth2ProviderAppSecret(ctx, database.InsertOAuth2ProviderAppSecretParams{
-		ID:           uuid.New(),
-		CreatedAt:    dbtime.Now(),
-		SecretPrefix: []byte(secret.Prefix),
-		HashedSecret: []byte(secret.Hashed),
-		// DisplaySecret is the last six characters of the original unhashed secret.
-		// This is done so they can be differentiated and it matches how GitHub
-		// displays their client secrets.
-		DisplaySecret: secret.Formatted[len(secret.Formatted)-6:],
-		AppID:         app.ID,
-	})
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error creating OAuth2 client secret.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-	aReq.New = dbSecret
-	httpapi.Write(ctx, rw, http.StatusCreated, codersdk.OAuth2ProviderAppSecretFull{
-		ID:               dbSecret.ID,
-		ClientSecretFull: secret.Formatted,
-	})
+func (api *API) postOAuth2ProviderAppSecret() http.HandlerFunc {
+	return oauth2provider.CreateAppSecret(api.Database, api.Auditor.Load(), api.Logger)
 }
 
 // @Summary Delete OAuth2 application secret.
@@ -315,29 +100,8 @@ func (api *API) postOAuth2ProviderAppSecret(rw http.ResponseWriter, r *http.Requ
 // @Param secretID path string true "Secret ID"
 // @Success 204
 // @Router /oauth2-provider/apps/{app}/secrets/{secretID} [delete]
-func (api *API) deleteOAuth2ProviderAppSecret(rw http.ResponseWriter, r *http.Request) {
-	var (
-		ctx               = r.Context()
-		secret            = httpmw.OAuth2ProviderAppSecret(r)
-		auditor           = api.Auditor.Load()
-		aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderAppSecret](rw, &audit.RequestParams{
-			Audit:   *auditor,
-			Log:     api.Logger,
-			Request: r,
-			Action:  database.AuditActionDelete,
-		})
-	)
-	aReq.Old = secret
-	defer commitAudit()
-	err := api.Database.DeleteOAuth2ProviderAppSecretByID(ctx, secret.ID)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error deleting OAuth2 client secret.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-	rw.WriteHeader(http.StatusNoContent)
+func (api *API) deleteOAuth2ProviderAppSecret() http.HandlerFunc {
+	return oauth2provider.DeleteAppSecret(api.Database, api.Auditor.Load(), api.Logger)
 }
 
 // @Summary OAuth2 authorization request (GET - show authorization page).
@@ -352,7 +116,7 @@ func (api *API) deleteOAuth2ProviderAppSecret(rw http.ResponseWriter, r *http.Re
 // @Success 200 "Returns HTML authorization page"
 // @Router /oauth2/authorize [get]
 func (api *API) getOAuth2ProviderAppAuthorize() http.HandlerFunc {
-	return identityprovider.ShowAuthorizePage(api.Database, api.AccessURL)
+	return oauth2provider.ShowAuthorizePage(api.Database, api.AccessURL)
 }
 
 // @Summary OAuth2 authorization request (POST - process authorization).
@@ -367,7 +131,7 @@ func (api *API) getOAuth2ProviderAppAuthorize() http.HandlerFunc {
 // @Success 302 "Returns redirect with authorization code"
 // @Router /oauth2/authorize [post]
 func (api *API) postOAuth2ProviderAppAuthorize() http.HandlerFunc {
-	return identityprovider.ProcessAuthorize(api.Database, api.AccessURL)
+	return oauth2provider.ProcessAuthorize(api.Database, api.AccessURL)
 }
 
 // @Summary OAuth2 token exchange.
@@ -382,7 +146,7 @@ func (api *API) postOAuth2ProviderAppAuthorize() http.HandlerFunc {
 // @Success 200 {object} oauth2.Token
 // @Router /oauth2/tokens [post]
 func (api *API) postOAuth2ProviderAppToken() http.HandlerFunc {
-	return identityprovider.Tokens(api.Database, api.DeploymentValues.Sessions)
+	return oauth2provider.Tokens(api.Database, api.DeploymentValues.Sessions)
 }
 
 // @Summary Delete OAuth2 application tokens.
@@ -393,7 +157,7 @@ func (api *API) postOAuth2ProviderAppToken() http.HandlerFunc {
 // @Success 204
 // @Router /oauth2/tokens [delete]
 func (api *API) deleteOAuth2ProviderAppTokens() http.HandlerFunc {
-	return identityprovider.RevokeApp(api.Database)
+	return oauth2provider.RevokeApp(api.Database)
 }
 
 // @Summary OAuth2 authorization server metadata.
@@ -402,20 +166,8 @@ func (api *API) deleteOAuth2ProviderAppTokens() http.HandlerFunc {
 // @Tags Enterprise
 // @Success 200 {object} codersdk.OAuth2AuthorizationServerMetadata
 // @Router /.well-known/oauth-authorization-server [get]
-func (api *API) oauth2AuthorizationServerMetadata(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	metadata := codersdk.OAuth2AuthorizationServerMetadata{
-		Issuer:                        api.AccessURL.String(),
-		AuthorizationEndpoint:         api.AccessURL.JoinPath("/oauth2/authorize").String(),
-		TokenEndpoint:                 api.AccessURL.JoinPath("/oauth2/tokens").String(),
-		ResponseTypesSupported:        []string{"code"},
-		GrantTypesSupported:           []string{"authorization_code", "refresh_token"},
-		CodeChallengeMethodsSupported: []string{"S256"},
-		// TODO: Implement scope system
-		ScopesSupported:                   []string{},
-		TokenEndpointAuthMethodsSupported: []string{"client_secret_post"},
-	}
-	httpapi.Write(ctx, rw, http.StatusOK, metadata)
+func (api *API) oauth2AuthorizationServerMetadata() http.HandlerFunc {
+	return oauth2provider.GetAuthorizationServerMetadata(api.AccessURL)
 }
 
 // @Summary OAuth2 protected resource metadata.
@@ -424,15 +176,53 @@ func (api *API) oauth2AuthorizationServerMetadata(rw http.ResponseWriter, r *htt
 // @Tags Enterprise
 // @Success 200 {object} codersdk.OAuth2ProtectedResourceMetadata
 // @Router /.well-known/oauth-protected-resource [get]
-func (api *API) oauth2ProtectedResourceMetadata(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	metadata := codersdk.OAuth2ProtectedResourceMetadata{
-		Resource:             api.AccessURL.String(),
-		AuthorizationServers: []string{api.AccessURL.String()},
-		// TODO: Implement scope system based on RBAC permissions
-		ScopesSupported: []string{},
-		// RFC 6750 Bearer Token methods supported as fallback methods in api key middleware
-		BearerMethodsSupported: []string{"header", "query"},
-	}
-	httpapi.Write(ctx, rw, http.StatusOK, metadata)
+func (api *API) oauth2ProtectedResourceMetadata() http.HandlerFunc {
+	return oauth2provider.GetProtectedResourceMetadata(api.AccessURL)
+}
+
+// @Summary OAuth2 dynamic client registration (RFC 7591)
+// @ID oauth2-dynamic-client-registration
+// @Accept json
+// @Produce json
+// @Tags Enterprise
+// @Param request body codersdk.OAuth2ClientRegistrationRequest true "Client registration request"
+// @Success 201 {object} codersdk.OAuth2ClientRegistrationResponse
+// @Router /oauth2/register [post]
+func (api *API) postOAuth2ClientRegistration() http.HandlerFunc {
+	return oauth2provider.CreateDynamicClientRegistration(api.Database, api.AccessURL, api.Auditor.Load(), api.Logger)
+}
+
+// @Summary Get OAuth2 client configuration (RFC 7592)
+// @ID get-oauth2-client-configuration
+// @Accept json
+// @Produce json
+// @Tags Enterprise
+// @Param client_id path string true "Client ID"
+// @Success 200 {object} codersdk.OAuth2ClientConfiguration
+// @Router /oauth2/clients/{client_id} [get]
+func (api *API) oauth2ClientConfiguration() http.HandlerFunc {
+	return oauth2provider.GetClientConfiguration(api.Database)
+}
+
+// @Summary Update OAuth2 client configuration (RFC 7592)
+// @ID put-oauth2-client-configuration
+// @Accept json
+// @Produce json
+// @Tags Enterprise
+// @Param client_id path string true "Client ID"
+// @Param request body codersdk.OAuth2ClientRegistrationRequest true "Client update request"
+// @Success 200 {object} codersdk.OAuth2ClientConfiguration
+// @Router /oauth2/clients/{client_id} [put]
+func (api *API) putOAuth2ClientConfiguration() http.HandlerFunc {
+	return oauth2provider.UpdateClientConfiguration(api.Database, api.Auditor.Load(), api.Logger)
+}
+
+// @Summary Delete OAuth2 client registration (RFC 7592)
+// @ID delete-oauth2-client-configuration
+// @Tags Enterprise
+// @Param client_id path string true "Client ID"
+// @Success 204
+// @Router /oauth2/clients/{client_id} [delete]
+func (api *API) deleteOAuth2ClientConfiguration() http.HandlerFunc {
+	return oauth2provider.DeleteClientConfiguration(api.Database, api.Auditor.Load(), api.Logger)
 }
diff --git a/coderd/oauth2_error_compliance_test.go b/coderd/oauth2_error_compliance_test.go
new file mode 100644
index 0000000000000..ce481e6af37a0
--- /dev/null
+++ b/coderd/oauth2_error_compliance_test.go
@@ -0,0 +1,432 @@
+package coderd_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
+)
+
+// OAuth2ErrorResponse represents RFC-compliant OAuth2 error responses
+type OAuth2ErrorResponse struct {
+	Error            string `json:"error"`
+	ErrorDescription string `json:"error_description,omitempty"`
+	ErrorURI         string `json:"error_uri,omitempty"`
+}
+
+// TestOAuth2ErrorResponseFormat tests that OAuth2 error responses follow proper RFC format
+func TestOAuth2ErrorResponseFormat(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ContentTypeHeader", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Make a request that will definitely fail
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			// Missing required redirect_uris
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.Error(t, err)
+
+		// Check that it's an HTTP error with JSON content type
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+
+		// The error should be a 400 status for invalid client metadata
+		require.Equal(t, http.StatusBadRequest, httpErr.StatusCode())
+	})
+}
+
+// TestOAuth2RegistrationErrorCodes tests all RFC 7591 error codes
+func TestOAuth2RegistrationErrorCodes(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name          string
+		req           codersdk.OAuth2ClientRegistrationRequest
+		expectedError string
+		expectedCode  int
+	}{
+		{
+			name: "InvalidClientMetadata_NoRedirectURIs",
+			req: codersdk.OAuth2ClientRegistrationRequest{
+				ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+				// Missing required redirect_uris
+			},
+			expectedError: "invalid_client_metadata",
+			expectedCode:  http.StatusBadRequest,
+		},
+		{
+			name: "InvalidClientMetadata_InvalidRedirectURI",
+			req: codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"not-a-valid-uri"},
+				ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+			},
+			expectedError: "invalid_client_metadata",
+			expectedCode:  http.StatusBadRequest,
+		},
+		{
+			name: "InvalidClientMetadata_RedirectURIWithFragment",
+			req: codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"https://example.com/callback#fragment"},
+				ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+			},
+			expectedError: "invalid_client_metadata",
+			expectedCode:  http.StatusBadRequest,
+		},
+		{
+			name: "InvalidClientMetadata_HTTPRedirectForNonLocalhost",
+			req: codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"http://example.com/callback"}, // HTTP for non-localhost
+				ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+			},
+			expectedError: "invalid_client_metadata",
+			expectedCode:  http.StatusBadRequest,
+		},
+		{
+			name: "InvalidClientMetadata_UnsupportedGrantType",
+			req: codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"https://example.com/callback"},
+				ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+				GrantTypes:   []string{"unsupported_grant_type"},
+			},
+			expectedError: "invalid_client_metadata",
+			expectedCode:  http.StatusBadRequest,
+		},
+		{
+			name: "InvalidClientMetadata_UnsupportedResponseType",
+			req: codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs:  []string{"https://example.com/callback"},
+				ClientName:    fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+				ResponseTypes: []string{"unsupported_response_type"},
+			},
+			expectedError: "invalid_client_metadata",
+			expectedCode:  http.StatusBadRequest,
+		},
+		{
+			name: "InvalidClientMetadata_UnsupportedAuthMethod",
+			req: codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs:            []string{"https://example.com/callback"},
+				ClientName:              fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+				TokenEndpointAuthMethod: "unsupported_auth_method",
+			},
+			expectedError: "invalid_client_metadata",
+			expectedCode:  http.StatusBadRequest,
+		},
+		{
+			name: "InvalidClientMetadata_InvalidClientURI",
+			req: codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"https://example.com/callback"},
+				ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+				ClientURI:    "not-a-valid-uri",
+			},
+			expectedError: "invalid_client_metadata",
+			expectedCode:  http.StatusBadRequest,
+		},
+		{
+			name: "InvalidClientMetadata_InvalidLogoURI",
+			req: codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"https://example.com/callback"},
+				ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+				LogoURI:      "not-a-valid-uri",
+			},
+			expectedError: "invalid_client_metadata",
+			expectedCode:  http.StatusBadRequest,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			_ = coderdtest.CreateFirstUser(t, client)
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			// Create a copy of the request with a unique client name
+			req := test.req
+			if req.ClientName != "" {
+				req.ClientName = fmt.Sprintf("%s-%d", req.ClientName, time.Now().UnixNano())
+			}
+
+			_, err := client.PostOAuth2ClientRegistration(ctx, req)
+			require.Error(t, err)
+
+			// Validate error format and status code
+			var httpErr *codersdk.Error
+			require.ErrorAs(t, err, &httpErr)
+			require.Equal(t, test.expectedCode, httpErr.StatusCode())
+
+			// For now, just verify we get an error with the expected status code
+			// The specific error message format can be verified in other ways
+			require.True(t, httpErr.StatusCode() >= 400)
+		})
+	}
+}
+
+// TestOAuth2ManagementErrorCodes tests all RFC 7592 error codes
+func TestOAuth2ManagementErrorCodes(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name             string
+		useWrongClientID bool
+		useWrongToken    bool
+		useEmptyToken    bool
+		expectedError    string
+		expectedCode     int
+	}{
+		{
+			name:          "InvalidToken_WrongToken",
+			useWrongToken: true,
+			expectedError: "invalid_token",
+			expectedCode:  http.StatusUnauthorized,
+		},
+		{
+			name:          "InvalidToken_EmptyToken",
+			useEmptyToken: true,
+			expectedError: "invalid_token",
+			expectedCode:  http.StatusUnauthorized,
+		},
+		{
+			name:             "InvalidClient_WrongClientID",
+			useWrongClientID: true,
+			expectedError:    "invalid_token",
+			expectedCode:     http.StatusUnauthorized,
+		},
+		// Skip empty client ID test as it causes routing issues
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			_ = coderdtest.CreateFirstUser(t, client)
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			// First register a valid client to use for management tests
+			clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano())
+			regReq := codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"https://example.com/callback"},
+				ClientName:   clientName,
+			}
+			regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq)
+			require.NoError(t, err)
+
+			// Determine clientID and token based on test configuration
+			var clientID, token string
+			switch {
+			case test.useWrongClientID:
+				clientID = "550e8400-e29b-41d4-a716-446655440000" // Valid UUID format but non-existent
+				token = regResp.RegistrationAccessToken
+			case test.useWrongToken:
+				clientID = regResp.ClientID
+				token = "invalid-token"
+			case test.useEmptyToken:
+				clientID = regResp.ClientID
+				token = ""
+			default:
+				clientID = regResp.ClientID
+				token = regResp.RegistrationAccessToken
+			}
+
+			// Test GET client configuration
+			_, err = client.GetOAuth2ClientConfiguration(ctx, clientID, token)
+			require.Error(t, err)
+
+			var httpErr *codersdk.Error
+			require.ErrorAs(t, err, &httpErr)
+			require.Equal(t, test.expectedCode, httpErr.StatusCode())
+			// Verify we get an appropriate error status code
+			require.True(t, httpErr.StatusCode() >= 400)
+
+			// Test PUT client configuration (except for empty client ID which causes routing issues)
+			if clientID != "" {
+				updateReq := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs: []string{"https://updated.example.com/callback"},
+					ClientName:   clientName + "-updated",
+				}
+				_, err = client.PutOAuth2ClientConfiguration(ctx, clientID, token, updateReq)
+				require.Error(t, err)
+
+				require.ErrorAs(t, err, &httpErr)
+				require.Equal(t, test.expectedCode, httpErr.StatusCode())
+				require.True(t, httpErr.StatusCode() >= 400)
+
+				// Test DELETE client configuration
+				err = client.DeleteOAuth2ClientConfiguration(ctx, clientID, token)
+				require.Error(t, err)
+
+				require.ErrorAs(t, err, &httpErr)
+				require.Equal(t, test.expectedCode, httpErr.StatusCode())
+				require.True(t, httpErr.StatusCode() >= 400)
+			}
+		})
+	}
+}
+
+// TestOAuth2ErrorResponseStructure tests the JSON structure of error responses
+func TestOAuth2ErrorResponseStructure(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ErrorFieldsPresent", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Make a request that will generate an error
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"invalid-uri"},
+			ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.Error(t, err)
+
+		// Validate that the error contains the expected OAuth2 error structure
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+
+		// The error should be a 400 status for invalid client metadata
+		require.Equal(t, http.StatusBadRequest, httpErr.StatusCode())
+
+		// Should have error details
+		require.NotEmpty(t, httpErr.Message)
+	})
+
+	t.Run("RegistrationAccessTokenErrors", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Try to access a client configuration with invalid token - use a valid UUID format
+		validUUID := "550e8400-e29b-41d4-a716-446655440000"
+		_, err := client.GetOAuth2ClientConfiguration(ctx, validUUID, "invalid-token")
+		require.Error(t, err)
+
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+		require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode())
+	})
+}
+
+// TestOAuth2ErrorHTTPHeaders tests that error responses have correct HTTP headers
+func TestOAuth2ErrorHTTPHeaders(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ContentTypeJSON", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Make a request that will fail
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			// Missing required fields
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.Error(t, err)
+
+		// The error should indicate proper JSON response format
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+		require.NotEmpty(t, httpErr.Message)
+	})
+}
+
+// TestOAuth2SpecificErrorScenarios tests specific error scenarios from RFC specifications
+func TestOAuth2SpecificErrorScenarios(t *testing.T) {
+	t.Parallel()
+
+	t.Run("MissingRequiredFields", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Test completely empty request
+		req := codersdk.OAuth2ClientRegistrationRequest{}
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.Error(t, err)
+
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+		require.Equal(t, http.StatusBadRequest, httpErr.StatusCode())
+		// Error properly returned with bad request status
+	})
+
+	t.Run("InvalidJSONStructure", func(t *testing.T) {
+		t.Parallel()
+
+		// For invalid JSON structure, we'd need to make raw HTTP requests
+		// This is tested implicitly through the other tests since we're using
+		// typed requests that ensure proper JSON structure
+	})
+
+	t.Run("UnsupportedFields", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Test with fields that might not be supported yet
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs:            []string{"https://example.com/callback"},
+			ClientName:              fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+			TokenEndpointAuthMethod: "private_key_jwt", // Not supported yet
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.Error(t, err)
+
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+		require.Equal(t, http.StatusBadRequest, httpErr.StatusCode())
+		// Error properly returned with bad request status
+	})
+
+	t.Run("SecurityBoundaryErrors", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Register a client first
+		clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano())
+		regReq := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/callback"},
+			ClientName:   clientName,
+		}
+		regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq)
+		require.NoError(t, err)
+
+		// Try to access with completely wrong token format
+		_, err = client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, "malformed-token-format")
+		require.Error(t, err)
+
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+		require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode())
+	})
+}
diff --git a/coderd/oauth2_metadata_validation_test.go b/coderd/oauth2_metadata_validation_test.go
new file mode 100644
index 0000000000000..1f70d42b45899
--- /dev/null
+++ b/coderd/oauth2_metadata_validation_test.go
@@ -0,0 +1,782 @@
+package coderd_test
+
+import (
+	"fmt"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
+)
+
+// TestOAuth2ClientMetadataValidation tests enhanced metadata validation per RFC 7591
+func TestOAuth2ClientMetadataValidation(t *testing.T) {
+	t.Parallel()
+
+	t.Run("RedirectURIValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name          string
+			redirectURIs  []string
+			expectError   bool
+			errorContains string
+		}{
+			{
+				name:         "ValidHTTPS",
+				redirectURIs: []string{"https://example.com/callback"},
+				expectError:  false,
+			},
+			{
+				name:         "ValidLocalhost",
+				redirectURIs: []string{"http://localhost:8080/callback"},
+				expectError:  false,
+			},
+			{
+				name:         "ValidLocalhostIP",
+				redirectURIs: []string{"http://127.0.0.1:8080/callback"},
+				expectError:  false,
+			},
+			{
+				name:         "ValidCustomScheme",
+				redirectURIs: []string{"com.example.myapp://auth/callback"},
+				expectError:  false,
+			},
+			{
+				name:          "InvalidHTTPNonLocalhost",
+				redirectURIs:  []string{"http://example.com/callback"},
+				expectError:   true,
+				errorContains: "redirect_uri",
+			},
+			{
+				name:          "InvalidWithFragment",
+				redirectURIs:  []string{"https://example.com/callback#fragment"},
+				expectError:   true,
+				errorContains: "fragment",
+			},
+			{
+				name:          "InvalidJavaScriptScheme",
+				redirectURIs:  []string{"javascript:alert('xss')"},
+				expectError:   true,
+				errorContains: "dangerous scheme",
+			},
+			{
+				name:          "InvalidDataScheme",
+				redirectURIs:  []string{"data:text/html,<script>alert('xss')</script>"},
+				expectError:   true,
+				errorContains: "dangerous scheme",
+			},
+			{
+				name:          "InvalidFileScheme",
+				redirectURIs:  []string{"file:///etc/passwd"},
+				expectError:   true,
+				errorContains: "dangerous scheme",
+			},
+			{
+				name:          "EmptyString",
+				redirectURIs:  []string{""},
+				expectError:   true,
+				errorContains: "redirect_uri",
+			},
+			{
+				name:          "RelativeURL",
+				redirectURIs:  []string{"/callback"},
+				expectError:   true,
+				errorContains: "redirect_uri",
+			},
+			{
+				name:         "MultipleValid",
+				redirectURIs: []string{"https://example.com/callback", "com.example.app://auth"},
+				expectError:  false,
+			},
+			{
+				name:          "MixedValidInvalid",
+				redirectURIs:  []string{"https://example.com/callback", "http://example.com/callback"},
+				expectError:   true,
+				errorContains: "redirect_uri",
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs: test.redirectURIs,
+					ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+					if test.errorContains != "" {
+						require.Contains(t, strings.ToLower(err.Error()), strings.ToLower(test.errorContains))
+					}
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("ClientURIValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name        string
+			clientURI   string
+			expectError bool
+		}{
+			{
+				name:        "ValidHTTPS",
+				clientURI:   "https://example.com",
+				expectError: false,
+			},
+			{
+				name:        "ValidHTTPLocalhost",
+				clientURI:   "http://localhost:8080",
+				expectError: false,
+			},
+			{
+				name:        "ValidWithPath",
+				clientURI:   "https://example.com/app",
+				expectError: false,
+			},
+			{
+				name:        "ValidWithQuery",
+				clientURI:   "https://example.com/app?param=value",
+				expectError: false,
+			},
+			{
+				name:        "InvalidNotURL",
+				clientURI:   "not-a-url",
+				expectError: true,
+			},
+			{
+				name:        "ValidWithFragment",
+				clientURI:   "https://example.com#fragment",
+				expectError: false, // Fragments are allowed in client_uri, unlike redirect_uri
+			},
+			{
+				name:        "InvalidJavaScript",
+				clientURI:   "javascript:alert('xss')",
+				expectError: true, // Only http/https allowed for client_uri
+			},
+			{
+				name:        "InvalidFTP",
+				clientURI:   "ftp://example.com",
+				expectError: true, // Only http/https allowed for client_uri
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs: []string{"https://example.com/callback"},
+					ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+					ClientURI:    test.clientURI,
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("LogoURIValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name        string
+			logoURI     string
+			expectError bool
+		}{
+			{
+				name:        "ValidHTTPS",
+				logoURI:     "https://example.com/logo.png",
+				expectError: false,
+			},
+			{
+				name:        "ValidHTTPLocalhost",
+				logoURI:     "http://localhost:8080/logo.png",
+				expectError: false,
+			},
+			{
+				name:        "ValidWithQuery",
+				logoURI:     "https://example.com/logo.png?size=large",
+				expectError: false,
+			},
+			{
+				name:        "InvalidNotURL",
+				logoURI:     "not-a-url",
+				expectError: true,
+			},
+			{
+				name:        "ValidWithFragment",
+				logoURI:     "https://example.com/logo.png#fragment",
+				expectError: false, // Fragments are allowed in logo_uri
+			},
+			{
+				name:        "InvalidJavaScript",
+				logoURI:     "javascript:alert('xss')",
+				expectError: true, // Only http/https allowed for logo_uri
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs: []string{"https://example.com/callback"},
+					ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+					LogoURI:      test.logoURI,
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("GrantTypeValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name        string
+			grantTypes  []string
+			expectError bool
+		}{
+			{
+				name:        "DefaultEmpty",
+				grantTypes:  []string{},
+				expectError: false,
+			},
+			{
+				name:        "ValidAuthorizationCode",
+				grantTypes:  []string{"authorization_code"},
+				expectError: false,
+			},
+			{
+				name:        "InvalidRefreshTokenAlone",
+				grantTypes:  []string{"refresh_token"},
+				expectError: true, // refresh_token requires authorization_code to be present
+			},
+			{
+				name:        "ValidMultiple",
+				grantTypes:  []string{"authorization_code", "refresh_token"},
+				expectError: false,
+			},
+			{
+				name:        "InvalidUnsupported",
+				grantTypes:  []string{"client_credentials"},
+				expectError: true,
+			},
+			{
+				name:        "InvalidPassword",
+				grantTypes:  []string{"password"},
+				expectError: true,
+			},
+			{
+				name:        "InvalidImplicit",
+				grantTypes:  []string{"implicit"},
+				expectError: true,
+			},
+			{
+				name:        "MixedValidInvalid",
+				grantTypes:  []string{"authorization_code", "client_credentials"},
+				expectError: true,
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs: []string{"https://example.com/callback"},
+					ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+					GrantTypes:   test.grantTypes,
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("ResponseTypeValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name          string
+			responseTypes []string
+			expectError   bool
+		}{
+			{
+				name:          "DefaultEmpty",
+				responseTypes: []string{},
+				expectError:   false,
+			},
+			{
+				name:          "ValidCode",
+				responseTypes: []string{"code"},
+				expectError:   false,
+			},
+			{
+				name:          "InvalidToken",
+				responseTypes: []string{"token"},
+				expectError:   true,
+			},
+			{
+				name:          "InvalidImplicit",
+				responseTypes: []string{"id_token"},
+				expectError:   true,
+			},
+			{
+				name:          "InvalidMultiple",
+				responseTypes: []string{"code", "token"},
+				expectError:   true,
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs:  []string{"https://example.com/callback"},
+					ClientName:    fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+					ResponseTypes: test.responseTypes,
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("TokenEndpointAuthMethodValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name        string
+			authMethod  string
+			expectError bool
+		}{
+			{
+				name:        "DefaultEmpty",
+				authMethod:  "",
+				expectError: false,
+			},
+			{
+				name:        "ValidClientSecretBasic",
+				authMethod:  "client_secret_basic",
+				expectError: false,
+			},
+			{
+				name:        "ValidClientSecretPost",
+				authMethod:  "client_secret_post",
+				expectError: false,
+			},
+			{
+				name:        "ValidNone",
+				authMethod:  "none",
+				expectError: false, // "none" is valid for public clients per RFC 7591
+			},
+			{
+				name:        "InvalidPrivateKeyJWT",
+				authMethod:  "private_key_jwt",
+				expectError: true,
+			},
+			{
+				name:        "InvalidClientSecretJWT",
+				authMethod:  "client_secret_jwt",
+				expectError: true,
+			},
+			{
+				name:        "InvalidCustom",
+				authMethod:  "custom_method",
+				expectError: true,
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs:            []string{"https://example.com/callback"},
+					ClientName:              fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+					TokenEndpointAuthMethod: test.authMethod,
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+}
+
+// TestOAuth2ClientNameValidation tests client name validation requirements
+func TestOAuth2ClientNameValidation(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name        string
+		clientName  string
+		expectError bool
+	}{
+		{
+			name:        "ValidBasic",
+			clientName:  "My App",
+			expectError: false,
+		},
+		{
+			name:        "ValidWithNumbers",
+			clientName:  "My App 2.0",
+			expectError: false,
+		},
+		{
+			name:        "ValidWithSpecialChars",
+			clientName:  "My-App_v1.0",
+			expectError: false,
+		},
+		{
+			name:        "ValidUnicode",
+			clientName:  "My App 🚀",
+			expectError: false,
+		},
+		{
+			name:        "ValidLong",
+			clientName:  strings.Repeat("A", 100),
+			expectError: false,
+		},
+		{
+			name:        "ValidEmpty",
+			clientName:  "",
+			expectError: false, // Empty names are allowed, defaults are applied
+		},
+		{
+			name:        "ValidWhitespaceOnly",
+			clientName:  "   ",
+			expectError: false, // Whitespace-only names are allowed
+		},
+		{
+			name:        "ValidTooLong",
+			clientName:  strings.Repeat("A", 1000),
+			expectError: false, // Very long names are allowed
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			_ = coderdtest.CreateFirstUser(t, client)
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			req := codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"https://example.com/callback"},
+				ClientName:   test.clientName,
+			}
+
+			_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+			if test.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+// TestOAuth2ClientScopeValidation tests scope parameter validation
+func TestOAuth2ClientScopeValidation(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name        string
+		scope       string
+		expectError bool
+	}{
+		{
+			name:        "DefaultEmpty",
+			scope:       "",
+			expectError: false,
+		},
+		{
+			name:        "ValidRead",
+			scope:       "read",
+			expectError: false,
+		},
+		{
+			name:        "ValidWrite",
+			scope:       "write",
+			expectError: false,
+		},
+		{
+			name:        "ValidMultiple",
+			scope:       "read write",
+			expectError: false,
+		},
+		{
+			name:        "ValidOpenID",
+			scope:       "openid",
+			expectError: false,
+		},
+		{
+			name:        "ValidProfile",
+			scope:       "profile",
+			expectError: false,
+		},
+		{
+			name:        "ValidEmail",
+			scope:       "email",
+			expectError: false,
+		},
+		{
+			name:        "ValidCombined",
+			scope:       "openid profile email read write",
+			expectError: false,
+		},
+		{
+			name:        "InvalidAdmin",
+			scope:       "admin",
+			expectError: false, // Admin scope should be allowed but validated during authorization
+		},
+		{
+			name:        "ValidCustom",
+			scope:       "custom:scope",
+			expectError: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			_ = coderdtest.CreateFirstUser(t, client)
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			req := codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"https://example.com/callback"},
+				ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+				Scope:        test.scope,
+			}
+
+			_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+			if test.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+// TestOAuth2ClientMetadataDefaults tests that default values are properly applied
+func TestOAuth2ClientMetadataDefaults(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, nil)
+	_ = coderdtest.CreateFirstUser(t, client)
+
+	ctx := testutil.Context(t, testutil.WaitLong)
+
+	// Register a minimal client to test defaults
+	req := codersdk.OAuth2ClientRegistrationRequest{
+		RedirectURIs: []string{"https://example.com/callback"},
+		ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+	}
+
+	resp, err := client.PostOAuth2ClientRegistration(ctx, req)
+	require.NoError(t, err)
+
+	// Get the configuration to check defaults
+	config, err := client.GetOAuth2ClientConfiguration(ctx, resp.ClientID, resp.RegistrationAccessToken)
+	require.NoError(t, err)
+
+	// Should default to authorization_code
+	require.Contains(t, config.GrantTypes, "authorization_code")
+
+	// Should default to code
+	require.Contains(t, config.ResponseTypes, "code")
+
+	// Should default to client_secret_basic or client_secret_post
+	require.True(t, config.TokenEndpointAuthMethod == "client_secret_basic" ||
+		config.TokenEndpointAuthMethod == "client_secret_post" ||
+		config.TokenEndpointAuthMethod == "")
+
+	// Client secret should be generated
+	require.NotEmpty(t, resp.ClientSecret)
+	require.Greater(t, len(resp.ClientSecret), 20)
+
+	// Registration access token should be generated
+	require.NotEmpty(t, resp.RegistrationAccessToken)
+	require.Greater(t, len(resp.RegistrationAccessToken), 20)
+}
+
+// TestOAuth2ClientMetadataEdgeCases tests edge cases and boundary conditions
+func TestOAuth2ClientMetadataEdgeCases(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ExtremelyLongRedirectURI", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Create a very long but valid HTTPS URI
+		longPath := strings.Repeat("a", 2000)
+		longURI := "https://example.com/" + longPath
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{longURI},
+			ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		// This might be accepted or rejected depending on URI length limits
+		// The test verifies the behavior is consistent
+		if err != nil {
+			require.Contains(t, strings.ToLower(err.Error()), "uri")
+		}
+	})
+
+	t.Run("ManyRedirectURIs", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Test with many redirect URIs
+		redirectURIs := make([]string, 20)
+		for i := 0; i < 20; i++ {
+			redirectURIs[i] = fmt.Sprintf("https://example%d.com/callback", i)
+		}
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: redirectURIs,
+			ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		// Should handle multiple redirect URIs gracefully
+		require.NoError(t, err)
+	})
+
+	t.Run("URIWithUnusualPort", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com:8443/callback"},
+			ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+	})
+
+	t.Run("URIWithComplexPath", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/path/to/callback?param=value&other=123"},
+			ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+	})
+
+	t.Run("URIWithEncodedCharacters", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Test with URL-encoded characters
+		encodedURI := "https://example.com/callback?param=" + url.QueryEscape("value with spaces")
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{encodedURI},
+			ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+	})
+}
diff --git a/coderd/oauth2_security_test.go b/coderd/oauth2_security_test.go
new file mode 100644
index 0000000000000..983a31651423c
--- /dev/null
+++ b/coderd/oauth2_security_test.go
@@ -0,0 +1,528 @@
+package coderd_test
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// TestOAuth2ClientIsolation tests that OAuth2 clients cannot access other clients' data
+func TestOAuth2ClientIsolation(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, nil)
+	_ = coderdtest.CreateFirstUser(t, client)
+
+	ctx := t.Context()
+
+	// Create two separate OAuth2 clients with unique identifiers
+	client1Name := fmt.Sprintf("test-client-1-%s-%d", t.Name(), time.Now().UnixNano())
+	client1Req := codersdk.OAuth2ClientRegistrationRequest{
+		RedirectURIs: []string{"https://client1.example.com/callback"},
+		ClientName:   client1Name,
+		ClientURI:    "https://client1.example.com",
+	}
+	client1Resp, err := client.PostOAuth2ClientRegistration(ctx, client1Req)
+	require.NoError(t, err)
+
+	client2Name := fmt.Sprintf("test-client-2-%s-%d", t.Name(), time.Now().UnixNano())
+	client2Req := codersdk.OAuth2ClientRegistrationRequest{
+		RedirectURIs: []string{"https://client2.example.com/callback"},
+		ClientName:   client2Name,
+		ClientURI:    "https://client2.example.com",
+	}
+	client2Resp, err := client.PostOAuth2ClientRegistration(ctx, client2Req)
+	require.NoError(t, err)
+
+	t.Run("ClientsCannotAccessOtherClientData", func(t *testing.T) {
+		t.Parallel()
+		ctx := t.Context()
+
+		// Client 1 should not be able to access Client 2's data using Client 1's token
+		_, err := client.GetOAuth2ClientConfiguration(ctx, client2Resp.ClientID, client1Resp.RegistrationAccessToken)
+		require.Error(t, err)
+
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+		require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode())
+
+		// Client 2 should not be able to access Client 1's data using Client 2's token
+		_, err = client.GetOAuth2ClientConfiguration(ctx, client1Resp.ClientID, client2Resp.RegistrationAccessToken)
+		require.Error(t, err)
+
+		require.ErrorAs(t, err, &httpErr)
+		require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode())
+	})
+
+	t.Run("ClientsCannotUpdateOtherClients", func(t *testing.T) {
+		t.Parallel()
+		ctx := t.Context()
+
+		// Client 1 should not be able to update Client 2 using Client 1's token
+		updateReq := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://malicious.example.com/callback"},
+			ClientName:   "Malicious Update",
+		}
+
+		_, err := client.PutOAuth2ClientConfiguration(ctx, client2Resp.ClientID, client1Resp.RegistrationAccessToken, updateReq)
+		require.Error(t, err)
+
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+		require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode())
+	})
+
+	t.Run("ClientsCannotDeleteOtherClients", func(t *testing.T) {
+		t.Parallel()
+		ctx := t.Context()
+
+		// Client 1 should not be able to delete Client 2 using Client 1's token
+		err := client.DeleteOAuth2ClientConfiguration(ctx, client2Resp.ClientID, client1Resp.RegistrationAccessToken)
+		require.Error(t, err)
+
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+		require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode())
+
+		// Verify Client 2 still exists and is accessible with its own token
+		config, err := client.GetOAuth2ClientConfiguration(ctx, client2Resp.ClientID, client2Resp.RegistrationAccessToken)
+		require.NoError(t, err)
+		require.Equal(t, client2Resp.ClientID, config.ClientID)
+	})
+}
+
+// TestOAuth2RegistrationTokenSecurity tests security aspects of registration access tokens
+func TestOAuth2RegistrationTokenSecurity(t *testing.T) {
+	t.Parallel()
+
+	t.Run("InvalidTokenFormats", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := t.Context()
+
+		// Register a client to use for testing
+		clientName := fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano())
+		regReq := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/callback"},
+			ClientName:   clientName,
+		}
+		regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq)
+		require.NoError(t, err)
+
+		invalidTokens := []string{
+			"",                        // Empty token
+			"invalid",                 // Too short
+			"not-base64-!@#$%^&*",     // Invalid characters
+			strings.Repeat("a", 1000), // Too long
+			"Bearer " + regResp.RegistrationAccessToken, // With Bearer prefix (incorrect)
+		}
+
+		for i, token := range invalidTokens {
+			t.Run(fmt.Sprintf("InvalidToken_%d", i), func(t *testing.T) {
+				t.Parallel()
+
+				_, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, token)
+				require.Error(t, err)
+
+				var httpErr *codersdk.Error
+				require.ErrorAs(t, err, &httpErr)
+				require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode())
+			})
+		}
+	})
+
+	t.Run("TokenNotReusableAcrossClients", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := t.Context()
+
+		// Register first client
+		client1Name := fmt.Sprintf("test-client-1-%s-%d", t.Name(), time.Now().UnixNano())
+		regReq1 := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/callback"},
+			ClientName:   client1Name,
+		}
+		regResp1, err := client.PostOAuth2ClientRegistration(ctx, regReq1)
+		require.NoError(t, err)
+
+		// Register another client
+		client2Name := fmt.Sprintf("test-client-2-%s-%d", t.Name(), time.Now().UnixNano())
+		regReq2 := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example2.com/callback"},
+			ClientName:   client2Name,
+		}
+		regResp2, err := client.PostOAuth2ClientRegistration(ctx, regReq2)
+		require.NoError(t, err)
+
+		// Try to use client1's token on client2
+		_, err = client.GetOAuth2ClientConfiguration(ctx, regResp2.ClientID, regResp1.RegistrationAccessToken)
+		require.Error(t, err)
+
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+		require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode())
+	})
+
+	t.Run("TokenNotExposedInGETResponse", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := t.Context()
+
+		// Register a client
+		clientName := fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano())
+		regReq := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/callback"},
+			ClientName:   clientName,
+		}
+		regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq)
+		require.NoError(t, err)
+
+		// Get client configuration
+		config, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, regResp.RegistrationAccessToken)
+		require.NoError(t, err)
+
+		// Registration access token should not be returned in GET responses (RFC 7592)
+		require.Empty(t, config.RegistrationAccessToken)
+	})
+}
+
+// TestOAuth2PrivilegeEscalation tests that clients cannot escalate their privileges
+func TestOAuth2PrivilegeEscalation(t *testing.T) {
+	t.Parallel()
+
+	t.Run("CannotEscalateScopeViaUpdate", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := t.Context()
+
+		// Register a basic client
+		clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano())
+		regReq := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/callback"},
+			ClientName:   clientName,
+			Scope:        "read", // Limited scope
+		}
+		regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq)
+		require.NoError(t, err)
+
+		// Try to escalate scope through update
+		updateReq := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/callback"},
+			ClientName:   clientName,
+			Scope:        "read write admin", // Trying to escalate to admin
+		}
+
+		// This should succeed (scope changes are allowed in updates)
+		// but the system should validate scope permissions appropriately
+		updatedConfig, err := client.PutOAuth2ClientConfiguration(ctx, regResp.ClientID, regResp.RegistrationAccessToken, updateReq)
+		if err == nil {
+			// If update succeeds, verify the scope was set appropriately
+			// (The actual scope validation would happen during token issuance)
+			require.Contains(t, updatedConfig.Scope, "read")
+		}
+	})
+
+	t.Run("CustomSchemeRedirectURIs", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := t.Context()
+
+		// Test valid custom schemes per RFC 7591/8252
+		validCustomSchemeRequests := []codersdk.OAuth2ClientRegistrationRequest{
+			{
+				RedirectURIs:            []string{"com.example.myapp://callback"},
+				ClientName:              fmt.Sprintf("native-app-1-%d", time.Now().UnixNano()),
+				TokenEndpointAuthMethod: "none", // Required for public clients using custom schemes
+			},
+			{
+				RedirectURIs:            []string{"com.example.app://oauth"},
+				ClientName:              fmt.Sprintf("native-app-2-%d", time.Now().UnixNano()),
+				TokenEndpointAuthMethod: "none", // Required for public clients using custom schemes
+			},
+			{
+				RedirectURIs:            []string{"urn:ietf:wg:oauth:2.0:oob"},
+				ClientName:              fmt.Sprintf("native-app-3-%d", time.Now().UnixNano()),
+				TokenEndpointAuthMethod: "none", // Required for public clients
+			},
+		}
+
+		for i, req := range validCustomSchemeRequests {
+			t.Run(fmt.Sprintf("ValidCustomSchemeRequest_%d", i), func(t *testing.T) {
+				t.Parallel()
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+				// Valid custom schemes should be allowed per RFC 7591/8252
+				require.NoError(t, err)
+			})
+		}
+
+		// Test that dangerous schemes are properly rejected for security
+		dangerousSchemeRequests := []struct {
+			req    codersdk.OAuth2ClientRegistrationRequest
+			scheme string
+		}{
+			{
+				req: codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs:            []string{"javascript:alert('test')"},
+					ClientName:              fmt.Sprintf("native-app-js-%d", time.Now().UnixNano()),
+					TokenEndpointAuthMethod: "none",
+				},
+				scheme: "javascript",
+			},
+			{
+				req: codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs:            []string{"data:text/html,<html></html>"},
+					ClientName:              fmt.Sprintf("native-app-data-%d", time.Now().UnixNano()),
+					TokenEndpointAuthMethod: "none",
+				},
+				scheme: "data",
+			},
+		}
+
+		for _, test := range dangerousSchemeRequests {
+			t.Run(fmt.Sprintf("DangerousScheme_%s", test.scheme), func(t *testing.T) {
+				t.Parallel()
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, test.req)
+				// Dangerous schemes should be rejected for security
+				require.Error(t, err)
+				require.Contains(t, err.Error(), "dangerous scheme")
+			})
+		}
+	})
+}
+
+// TestOAuth2InformationDisclosure tests that error messages don't leak sensitive information
+func TestOAuth2InformationDisclosure(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, nil)
+	_ = coderdtest.CreateFirstUser(t, client)
+
+	ctx := t.Context()
+
+	// Register a client for testing
+	clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano())
+	regReq := codersdk.OAuth2ClientRegistrationRequest{
+		RedirectURIs: []string{"https://example.com/callback"},
+		ClientName:   clientName,
+	}
+	regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq)
+	require.NoError(t, err)
+
+	t.Run("ErrorsDoNotLeakClientSecrets", func(t *testing.T) {
+		t.Parallel()
+		ctx := t.Context()
+
+		// Try various invalid operations and ensure they don't leak the client secret
+		_, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, "invalid-token")
+		require.Error(t, err)
+
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+
+		// Error message should not contain any part of the client secret or registration token
+		errorText := strings.ToLower(httpErr.Message + httpErr.Detail)
+		require.NotContains(t, errorText, strings.ToLower(regResp.ClientSecret))
+		require.NotContains(t, errorText, strings.ToLower(regResp.RegistrationAccessToken))
+	})
+
+	t.Run("ErrorsDoNotLeakDatabaseDetails", func(t *testing.T) {
+		t.Parallel()
+		ctx := t.Context()
+
+		// Try to access non-existent client
+		_, err := client.GetOAuth2ClientConfiguration(ctx, "non-existent-client-id", regResp.RegistrationAccessToken)
+		require.Error(t, err)
+
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+
+		// Error message should not leak database schema information
+		errorText := strings.ToLower(httpErr.Message + httpErr.Detail)
+		require.NotContains(t, errorText, "sql")
+		require.NotContains(t, errorText, "database")
+		require.NotContains(t, errorText, "table")
+		require.NotContains(t, errorText, "row")
+		require.NotContains(t, errorText, "constraint")
+	})
+
+	t.Run("ErrorsAreConsistentForInvalidClients", func(t *testing.T) {
+		t.Parallel()
+		ctx := t.Context()
+
+		// Test with various invalid client IDs to ensure consistent error responses
+		invalidClientIDs := []string{
+			"non-existent-1",
+			"non-existent-2",
+			"totally-different-format",
+		}
+
+		var errorMessages []string
+		for _, clientID := range invalidClientIDs {
+			_, err := client.GetOAuth2ClientConfiguration(ctx, clientID, regResp.RegistrationAccessToken)
+			require.Error(t, err)
+
+			var httpErr *codersdk.Error
+			require.ErrorAs(t, err, &httpErr)
+			errorMessages = append(errorMessages, httpErr.Message)
+		}
+
+		// All error messages should be similar (not leaking which client IDs exist vs don't exist)
+		for i := 1; i < len(errorMessages); i++ {
+			require.Equal(t, errorMessages[0], errorMessages[i])
+		}
+	})
+}
+
+// TestOAuth2ConcurrentSecurityOperations tests security under concurrent operations
+func TestOAuth2ConcurrentSecurityOperations(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, nil)
+	_ = coderdtest.CreateFirstUser(t, client)
+
+	ctx := t.Context()
+
+	// Register a client for testing
+	clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano())
+	regReq := codersdk.OAuth2ClientRegistrationRequest{
+		RedirectURIs: []string{"https://example.com/callback"},
+		ClientName:   clientName,
+	}
+	regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq)
+	require.NoError(t, err)
+
+	t.Run("ConcurrentAccessAttempts", func(t *testing.T) {
+		t.Parallel()
+		ctx := t.Context()
+
+		const numGoroutines = 20
+		var wg sync.WaitGroup
+		errors := make([]error, numGoroutines)
+
+		// Launch concurrent attempts to access the client configuration
+		for i := 0; i < numGoroutines; i++ {
+			wg.Add(1)
+			go func(index int) {
+				defer wg.Done()
+
+				_, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, regResp.RegistrationAccessToken)
+				errors[index] = err
+			}(i)
+		}
+
+		wg.Wait()
+
+		// All requests should succeed (they're all valid)
+		for i, err := range errors {
+			require.NoError(t, err, "Request %d failed", i)
+		}
+	})
+
+	t.Run("ConcurrentInvalidAccessAttempts", func(t *testing.T) {
+		t.Parallel()
+		ctx := t.Context()
+
+		const numGoroutines = 20
+		var wg sync.WaitGroup
+		statusCodes := make([]int, numGoroutines)
+
+		// Launch concurrent attempts with invalid tokens
+		for i := 0; i < numGoroutines; i++ {
+			wg.Add(1)
+			go func(index int) {
+				defer wg.Done()
+
+				_, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, fmt.Sprintf("invalid-token-%d", index))
+				if err == nil {
+					t.Errorf("Expected error for goroutine %d", index)
+					return
+				}
+
+				var httpErr *codersdk.Error
+				if !errors.As(err, &httpErr) {
+					t.Errorf("Expected codersdk.Error for goroutine %d", index)
+					return
+				}
+				statusCodes[index] = httpErr.StatusCode()
+			}(i)
+		}
+
+		wg.Wait()
+
+		// All requests should fail with 401 status
+		for i, statusCode := range statusCodes {
+			require.Equal(t, http.StatusUnauthorized, statusCode, "Request %d had unexpected status", i)
+		}
+	})
+
+	t.Run("ConcurrentClientDeletion", func(t *testing.T) {
+		t.Parallel()
+		ctx := t.Context()
+
+		// Register a client specifically for deletion testing
+		deleteClientName := fmt.Sprintf("delete-test-client-%d", time.Now().UnixNano())
+		deleteRegReq := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://delete-test.example.com/callback"},
+			ClientName:   deleteClientName,
+		}
+		deleteRegResp, err := client.PostOAuth2ClientRegistration(ctx, deleteRegReq)
+		require.NoError(t, err)
+
+		const numGoroutines = 5
+		var wg sync.WaitGroup
+		deleteResults := make([]error, numGoroutines)
+
+		// Launch concurrent deletion attempts
+		for i := 0; i < numGoroutines; i++ {
+			wg.Add(1)
+			go func(index int) {
+				defer wg.Done()
+
+				err := client.DeleteOAuth2ClientConfiguration(ctx, deleteRegResp.ClientID, deleteRegResp.RegistrationAccessToken)
+				deleteResults[index] = err
+			}(i)
+		}
+
+		wg.Wait()
+
+		// Only one deletion should succeed, others should fail
+		successCount := 0
+		for _, err := range deleteResults {
+			if err == nil {
+				successCount++
+			}
+		}
+
+		// At least one should succeed, and multiple successes are acceptable (idempotent operation)
+		require.Greater(t, successCount, 0, "At least one deletion should succeed")
+
+		// Verify the client is actually deleted
+		_, err = client.GetOAuth2ClientConfiguration(ctx, deleteRegResp.ClientID, deleteRegResp.RegistrationAccessToken)
+		require.Error(t, err)
+
+		var httpErr *codersdk.Error
+		require.ErrorAs(t, err, &httpErr)
+		require.True(t, httpErr.StatusCode() == http.StatusUnauthorized || httpErr.StatusCode() == http.StatusNotFound)
+	})
+}
diff --git a/coderd/oauth2_test.go b/coderd/oauth2_test.go
index 77a56a530b62e..04ce3d7519a31 100644
--- a/coderd/oauth2_test.go
+++ b/coderd/oauth2_test.go
@@ -22,7 +22,7 @@ import (
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbtestutil"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
-	"github.com/coder/coder/v2/coderd/identityprovider"
+	"github.com/coder/coder/v2/coderd/oauth2provider"
 	"github.com/coder/coder/v2/coderd/userpassword"
 	"github.com/coder/coder/v2/coderd/util/ptr"
 	"github.com/coder/coder/v2/codersdk"
@@ -32,244 +32,27 @@ import (
 func TestOAuth2ProviderApps(t *testing.T) {
 	t.Parallel()
 
-	t.Run("Validation", func(t *testing.T) {
-		t.Parallel()
-
-		client := coderdtest.New(t, nil)
-		_ = coderdtest.CreateFirstUser(t, client)
-
-		topCtx := testutil.Context(t, testutil.WaitLong)
-
-		tests := []struct {
-			name string
-			req  codersdk.PostOAuth2ProviderAppRequest
-		}{
-			{
-				name: "NameMissing",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					CallbackURL: "http://localhost:3000",
-				},
-			},
-			{
-				name: "NameSpaces",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name:        "foo bar",
-					CallbackURL: "http://localhost:3000",
-				},
-			},
-			{
-				name: "NameTooLong",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name:        "too loooooooooooooooooooooooooong",
-					CallbackURL: "http://localhost:3000",
-				},
-			},
-			{
-				name: "NameTaken",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name:        "taken",
-					CallbackURL: "http://localhost:3000",
-				},
-			},
-			{
-				name: "URLMissing",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name: "foo",
-				},
-			},
-			{
-				name: "URLLocalhostNoScheme",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name:        "foo",
-					CallbackURL: "localhost:3000",
-				},
-			},
-			{
-				name: "URLNoScheme",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name:        "foo",
-					CallbackURL: "coder.com",
-				},
-			},
-			{
-				name: "URLNoColon",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name:        "foo",
-					CallbackURL: "http//coder",
-				},
-			},
-			{
-				name: "URLJustBar",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name:        "foo",
-					CallbackURL: "bar",
-				},
-			},
-			{
-				name: "URLPathOnly",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name:        "foo",
-					CallbackURL: "/bar/baz/qux",
-				},
-			},
-			{
-				name: "URLJustHttp",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name:        "foo",
-					CallbackURL: "http",
-				},
-			},
-			{
-				name: "URLNoHost",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name:        "foo",
-					CallbackURL: "http://",
-				},
-			},
-			{
-				name: "URLSpaces",
-				req: codersdk.PostOAuth2ProviderAppRequest{
-					Name:        "foo",
-					CallbackURL: "bar baz qux",
-				},
-			},
-		}
-
-		// Generate an application for testing name conflicts.
-		req := codersdk.PostOAuth2ProviderAppRequest{
-			Name:        "taken",
-			CallbackURL: "http://coder.com",
-		}
-		//nolint:gocritic // OAauth2 app management requires owner permission.
-		_, err := client.PostOAuth2ProviderApp(topCtx, req)
-		require.NoError(t, err)
-
-		// Generate an application for testing PUTs.
-		req = codersdk.PostOAuth2ProviderAppRequest{
-			Name:        "quark",
-			CallbackURL: "http://coder.com",
-		}
-		//nolint:gocritic // OAauth2 app management requires owner permission.
-		existingApp, err := client.PostOAuth2ProviderApp(topCtx, req)
-		require.NoError(t, err)
-
-		for _, test := range tests {
-			t.Run(test.name, func(t *testing.T) {
-				t.Parallel()
-				ctx := testutil.Context(t, testutil.WaitLong)
-
-				//nolint:gocritic // OAauth2 app management requires owner permission.
-				_, err := client.PostOAuth2ProviderApp(ctx, test.req)
-				require.Error(t, err)
+	// NOTE: Unit tests for OAuth2 provider app validation have been migrated to
+	// oauth2provider/provider_test.go for better separation of concerns.
+	// This test function now focuses on integration testing with the full server stack.
 
-				//nolint:gocritic // OAauth2 app management requires owner permission.
-				_, err = client.PutOAuth2ProviderApp(ctx, existingApp.ID, codersdk.PutOAuth2ProviderAppRequest{
-					Name:        test.req.Name,
-					CallbackURL: test.req.CallbackURL,
-				})
-				require.Error(t, err)
-			})
-		}
-	})
-
-	t.Run("DeleteNonExisting", func(t *testing.T) {
+	t.Run("IntegrationFlow", func(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, nil)
-		owner := coderdtest.CreateFirstUser(t, client)
-		another, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
-
-		ctx := testutil.Context(t, testutil.WaitLong)
-
-		_, err := another.OAuth2ProviderApp(ctx, uuid.New())
-		require.Error(t, err)
-	})
-
-	t.Run("OK", func(t *testing.T) {
-		t.Parallel()
-
-		client := coderdtest.New(t, nil)
-		owner := coderdtest.CreateFirstUser(t, client)
-		another, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
-
+		_ = coderdtest.CreateFirstUser(t, client)
 		ctx := testutil.Context(t, testutil.WaitLong)
 
-		// No apps yet.
-		apps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{})
-		require.NoError(t, err)
-		require.Len(t, apps, 0)
-
-		// Should be able to add apps.
-		expected := generateApps(ctx, t, client, "get-apps")
-		expectedOrder := []codersdk.OAuth2ProviderApp{
-			expected.Default, expected.NoPort,
-			expected.Extra[0], expected.Extra[1], expected.Subdomain,
-		}
-
-		// Should get all the apps now.
-		apps, err = another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{})
-		require.NoError(t, err)
-		require.Len(t, apps, 5)
-		require.Equal(t, expectedOrder, apps)
-
-		// Should be able to keep the same name when updating.
-		req := codersdk.PutOAuth2ProviderAppRequest{
-			Name:        expected.Default.Name,
-			CallbackURL: "http://coder.com",
-			Icon:        "test",
-		}
-		//nolint:gocritic // OAauth2 app management requires owner permission.
-		newApp, err := client.PutOAuth2ProviderApp(ctx, expected.Default.ID, req)
-		require.NoError(t, err)
-		require.Equal(t, req.Name, newApp.Name)
-		require.Equal(t, req.CallbackURL, newApp.CallbackURL)
-		require.Equal(t, req.Icon, newApp.Icon)
-		require.Equal(t, expected.Default.ID, newApp.ID)
-
-		// Should be able to update name.
-		req = codersdk.PutOAuth2ProviderAppRequest{
-			Name:        "new-foo",
-			CallbackURL: "http://coder.com",
-			Icon:        "test",
-		}
-		//nolint:gocritic // OAauth2 app management requires owner permission.
-		newApp, err = client.PutOAuth2ProviderApp(ctx, expected.Default.ID, req)
-		require.NoError(t, err)
-		require.Equal(t, req.Name, newApp.Name)
-		require.Equal(t, req.CallbackURL, newApp.CallbackURL)
-		require.Equal(t, req.Icon, newApp.Icon)
-		require.Equal(t, expected.Default.ID, newApp.ID)
-
-		// Should be able to get a single app.
-		got, err := another.OAuth2ProviderApp(ctx, expected.Default.ID)
-		require.NoError(t, err)
-		require.Equal(t, newApp, got)
-
-		// Should be able to delete an app.
-		//nolint:gocritic // OAauth2 app management requires owner permission.
-		err = client.DeleteOAuth2ProviderApp(ctx, expected.Default.ID)
-		require.NoError(t, err)
-
-		// Should show the new count.
-		newApps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{})
-		require.NoError(t, err)
-		require.Len(t, newApps, 4)
-
-		require.Equal(t, expectedOrder[1:], newApps)
-	})
-
-	t.Run("ByUser", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, nil)
-		owner := coderdtest.CreateFirstUser(t, client)
-		another, user := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
-		ctx := testutil.Context(t, testutil.WaitLong)
-		_ = generateApps(ctx, t, client, "by-user")
-		apps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{
-			UserID: user.ID,
+		// Test basic app creation and management in integration context
+		//nolint:gocritic // OAuth2 app management requires owner permission.
+		app, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{
+			Name:        fmt.Sprintf("integration-test-%d", time.Now().UnixNano()%1000000),
+			CallbackURL: "http://localhost:3000",
 		})
 		require.NoError(t, err)
-		require.Len(t, apps, 0)
+		require.NotEmpty(t, app.ID)
+		require.NotEmpty(t, app.Name)
+		require.Equal(t, "http://localhost:3000", app.CallbackURL)
 	})
 }
 
@@ -279,10 +62,10 @@ func TestOAuth2ProviderAppSecrets(t *testing.T) {
 	client := coderdtest.New(t, nil)
 	_ = coderdtest.CreateFirstUser(t, client)
 
-	topCtx := testutil.Context(t, testutil.WaitLong)
+	ctx := testutil.Context(t, testutil.WaitLong)
 
 	// Make some apps.
-	apps := generateApps(topCtx, t, client, "app-secrets")
+	apps := generateApps(ctx, t, client, "app-secrets")
 
 	t.Run("DeleteNonExisting", func(t *testing.T) {
 		t.Parallel()
@@ -373,11 +156,11 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) {
 		Pubsub:   pubsub,
 	})
 	owner := coderdtest.CreateFirstUser(t, ownerClient)
-	topCtx := testutil.Context(t, testutil.WaitLong)
-	apps := generateApps(topCtx, t, ownerClient, "token-exchange")
+	ctx := testutil.Context(t, testutil.WaitLong)
+	apps := generateApps(ctx, t, ownerClient, "token-exchange")
 
 	//nolint:gocritic // OAauth2 app management requires owner permission.
-	secret, err := ownerClient.PostOAuth2ProviderAppSecret(topCtx, apps.Default.ID)
+	secret, err := ownerClient.PostOAuth2ProviderAppSecret(ctx, apps.Default.ID)
 	require.NoError(t, err)
 
 	// The typical oauth2 flow from this point is:
@@ -739,7 +522,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) {
 
 func TestOAuth2ProviderTokenRefresh(t *testing.T) {
 	t.Parallel()
-	topCtx := testutil.Context(t, testutil.WaitLong)
+	ctx := testutil.Context(t, testutil.WaitLong)
 
 	db, pubsub := dbtestutil.NewDB(t)
 	ownerClient := coderdtest.New(t, &coderdtest.Options{
@@ -747,10 +530,10 @@ func TestOAuth2ProviderTokenRefresh(t *testing.T) {
 		Pubsub:   pubsub,
 	})
 	owner := coderdtest.CreateFirstUser(t, ownerClient)
-	apps := generateApps(topCtx, t, ownerClient, "token-refresh")
+	apps := generateApps(ctx, t, ownerClient, "token-refresh")
 
 	//nolint:gocritic // OAauth2 app management requires owner permission.
-	secret, err := ownerClient.PostOAuth2ProviderAppSecret(topCtx, apps.Default.ID)
+	secret, err := ownerClient.PostOAuth2ProviderAppSecret(ctx, apps.Default.ID)
 	require.NoError(t, err)
 
 	// One path not tested here is when the token is empty, because Go's OAuth2
@@ -822,7 +605,7 @@ func TestOAuth2ProviderTokenRefresh(t *testing.T) {
 			newKey, err := db.InsertAPIKey(ctx, key)
 			require.NoError(t, err)
 
-			token, err := identityprovider.GenerateSecret()
+			token, err := oauth2provider.GenerateSecret()
 			require.NoError(t, err)
 
 			expires := test.expires
@@ -1126,11 +909,11 @@ func TestOAuth2ProviderResourceIndicators(t *testing.T) {
 		Pubsub:   pubsub,
 	})
 	owner := coderdtest.CreateFirstUser(t, ownerClient)
-	topCtx := testutil.Context(t, testutil.WaitLong)
-	apps := generateApps(topCtx, t, ownerClient, "resource-indicators")
+	ctx := testutil.Context(t, testutil.WaitLong)
+	apps := generateApps(ctx, t, ownerClient, "resource-indicators")
 
 	//nolint:gocritic // OAauth2 app management requires owner permission.
-	secret, err := ownerClient.PostOAuth2ProviderAppSecret(topCtx, apps.Default.ID)
+	secret, err := ownerClient.PostOAuth2ProviderAppSecret(ctx, apps.Default.ID)
 	require.NoError(t, err)
 
 	resource := ownerClient.URL.String()
@@ -1318,16 +1101,14 @@ func TestOAuth2ProviderCrossResourceAudienceValidation(t *testing.T) {
 		Pubsub:   pubsub,
 	})
 
-	topCtx := testutil.Context(t, testutil.WaitLong)
+	ctx := testutil.Context(t, testutil.WaitLong)
 
 	// Create OAuth2 app
-	apps := generateApps(topCtx, t, server1, "cross-resource")
+	apps := generateApps(ctx, t, server1, "cross-resource")
 
 	//nolint:gocritic // OAauth2 app management requires owner permission.
-	secret, err := server1.PostOAuth2ProviderAppSecret(topCtx, apps.Default.ID)
+	secret, err := server1.PostOAuth2ProviderAppSecret(ctx, apps.Default.ID)
 	require.NoError(t, err)
-
-	ctx := testutil.Context(t, testutil.WaitLong)
 	userClient, user := coderdtest.CreateAnotherUser(t, server1, owner.OrganizationID)
 
 	// Get token with specific audience for server1
@@ -1445,3 +1226,315 @@ func customTokenExchange(ctx context.Context, baseURL, clientID, clientSecret, c
 
 	return &token, nil
 }
+
+// TestOAuth2DynamicClientRegistration tests RFC 7591 dynamic client registration
+func TestOAuth2DynamicClientRegistration(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, nil)
+	_ = coderdtest.CreateFirstUser(t, client)
+
+	t.Run("BasicRegistration", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		clientName := fmt.Sprintf("test-client-basic-%d", time.Now().UnixNano())
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/callback"},
+			ClientName:   clientName,
+			ClientURI:    "https://example.com",
+			LogoURI:      "https://example.com/logo.png",
+			TOSURI:       "https://example.com/tos",
+			PolicyURI:    "https://example.com/privacy",
+			Contacts:     []string{"admin@example.com"},
+		}
+
+		// Register client
+		resp, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+
+		// Verify response fields
+		require.NotEmpty(t, resp.ClientID)
+		require.NotEmpty(t, resp.ClientSecret)
+		require.NotEmpty(t, resp.RegistrationAccessToken)
+		require.NotEmpty(t, resp.RegistrationClientURI)
+		require.Greater(t, resp.ClientIDIssuedAt, int64(0))
+		require.Equal(t, int64(0), resp.ClientSecretExpiresAt) // Non-expiring
+
+		// Verify default values
+		require.Contains(t, resp.GrantTypes, "authorization_code")
+		require.Contains(t, resp.GrantTypes, "refresh_token")
+		require.Contains(t, resp.ResponseTypes, "code")
+		require.Equal(t, "client_secret_basic", resp.TokenEndpointAuthMethod)
+
+		// Verify request values are preserved
+		require.Equal(t, req.RedirectURIs, resp.RedirectURIs)
+		require.Equal(t, req.ClientName, resp.ClientName)
+		require.Equal(t, req.ClientURI, resp.ClientURI)
+		require.Equal(t, req.LogoURI, resp.LogoURI)
+		require.Equal(t, req.TOSURI, resp.TOSURI)
+		require.Equal(t, req.PolicyURI, resp.PolicyURI)
+		require.Equal(t, req.Contacts, resp.Contacts)
+	})
+
+	t.Run("MinimalRegistration", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://minimal.com/callback"},
+		}
+
+		// Register client with minimal fields
+		resp, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+
+		// Should still get all required fields
+		require.NotEmpty(t, resp.ClientID)
+		require.NotEmpty(t, resp.ClientSecret)
+		require.NotEmpty(t, resp.RegistrationAccessToken)
+		require.NotEmpty(t, resp.RegistrationClientURI)
+
+		// Should have defaults applied
+		require.Contains(t, resp.GrantTypes, "authorization_code")
+		require.Contains(t, resp.ResponseTypes, "code")
+		require.Equal(t, "client_secret_basic", resp.TokenEndpointAuthMethod)
+	})
+
+	t.Run("InvalidRedirectURI", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"not-a-url"},
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid_client_metadata")
+	})
+
+	t.Run("NoRedirectURIs", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			ClientName: fmt.Sprintf("no-uris-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid_client_metadata")
+	})
+}
+
+// TestOAuth2ClientConfiguration tests RFC 7592 client configuration management
+func TestOAuth2ClientConfiguration(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, nil)
+	_ = coderdtest.CreateFirstUser(t, client)
+
+	// Helper to register a client
+	registerClient := func(t *testing.T) (string, string, string) {
+		ctx := testutil.Context(t, testutil.WaitLong)
+		// Use shorter client name to avoid database varchar(64) constraint
+		clientName := fmt.Sprintf("client-%d", time.Now().UnixNano())
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/callback"},
+			ClientName:   clientName,
+			ClientURI:    "https://example.com",
+		}
+
+		resp, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+		return resp.ClientID, resp.RegistrationAccessToken, clientName
+	}
+
+	t.Run("GetConfiguration", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitLong)
+		clientID, token, clientName := registerClient(t)
+
+		// Get client configuration
+		config, err := client.GetOAuth2ClientConfiguration(ctx, clientID, token)
+		require.NoError(t, err)
+
+		// Verify fields
+		require.Equal(t, clientID, config.ClientID)
+		require.Greater(t, config.ClientIDIssuedAt, int64(0))
+		require.Equal(t, []string{"https://example.com/callback"}, config.RedirectURIs)
+		require.Equal(t, clientName, config.ClientName)
+		require.Equal(t, "https://example.com", config.ClientURI)
+
+		// Should not contain client_secret in GET response
+		require.Empty(t, config.RegistrationAccessToken) // Not included in GET
+	})
+
+	t.Run("UpdateConfiguration", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		clientID, token, _ := registerClient(t)
+
+		// Update client configuration
+		updatedName := fmt.Sprintf("updated-test-client-%d", time.Now().UnixNano())
+		updateReq := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://newdomain.com/callback", "https://example.com/callback"},
+			ClientName:   updatedName,
+			ClientURI:    "https://newdomain.com",
+			LogoURI:      "https://newdomain.com/logo.png",
+		}
+
+		config, err := client.PutOAuth2ClientConfiguration(ctx, clientID, token, updateReq)
+		require.NoError(t, err)
+
+		// Verify updates
+		require.Equal(t, clientID, config.ClientID)
+		require.Equal(t, updateReq.RedirectURIs, config.RedirectURIs)
+		require.Equal(t, updateReq.ClientName, config.ClientName)
+		require.Equal(t, updateReq.ClientURI, config.ClientURI)
+		require.Equal(t, updateReq.LogoURI, config.LogoURI)
+	})
+
+	t.Run("DeleteConfiguration", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		clientID, token, _ := registerClient(t)
+
+		// Delete client
+		err := client.DeleteOAuth2ClientConfiguration(ctx, clientID, token)
+		require.NoError(t, err)
+
+		// Should no longer be able to get configuration
+		_, err = client.GetOAuth2ClientConfiguration(ctx, clientID, token)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid_token")
+	})
+
+	t.Run("InvalidToken", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		clientID, _, _ := registerClient(t)
+		invalidToken := "invalid-token"
+
+		// Should fail with invalid token
+		_, err := client.GetOAuth2ClientConfiguration(ctx, clientID, invalidToken)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid_token")
+	})
+
+	t.Run("NonexistentClient", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		fakeClientID := uuid.NewString()
+		fakeToken := "fake-token"
+
+		_, err := client.GetOAuth2ClientConfiguration(ctx, fakeClientID, fakeToken)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid_token")
+	})
+
+	t.Run("MissingAuthHeader", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		clientID, _, _ := registerClient(t)
+
+		// Try to access without token (empty string)
+		_, err := client.GetOAuth2ClientConfiguration(ctx, clientID, "")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid_token")
+	})
+}
+
+// TestOAuth2RegistrationAccessToken tests the registration access token middleware
+func TestOAuth2RegistrationAccessToken(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, nil)
+	_ = coderdtest.CreateFirstUser(t, client)
+
+	t.Run("ValidToken", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Register a client
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/callback"},
+			ClientName:   fmt.Sprintf("token-test-client-%d", time.Now().UnixNano()),
+		}
+
+		resp, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+
+		// Valid token should work
+		config, err := client.GetOAuth2ClientConfiguration(ctx, resp.ClientID, resp.RegistrationAccessToken)
+		require.NoError(t, err)
+		require.Equal(t, resp.ClientID, config.ClientID)
+	})
+
+	t.Run("ManuallyCreatedClient", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Create a client through the normal API (not dynamic registration)
+		appReq := codersdk.PostOAuth2ProviderAppRequest{
+			Name:        fmt.Sprintf("manual-%d", time.Now().UnixNano()%1000000),
+			CallbackURL: "https://manual.com/callback",
+		}
+
+		app, err := client.PostOAuth2ProviderApp(ctx, appReq)
+		require.NoError(t, err)
+
+		// Should not be able to manage via RFC 7592 endpoints
+		_, err = client.GetOAuth2ClientConfiguration(ctx, app.ID.String(), "any-token")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid_token") // Client was not dynamically registered
+	})
+
+	t.Run("TokenPasswordComparison", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Register two clients to ensure tokens are unique
+		timestamp := time.Now().UnixNano()
+		req1 := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://client1.com/callback"},
+			ClientName:   fmt.Sprintf("client-1-%d", timestamp),
+		}
+		req2 := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://client2.com/callback"},
+			ClientName:   fmt.Sprintf("client-2-%d", timestamp+1),
+		}
+
+		resp1, err := client.PostOAuth2ClientRegistration(ctx, req1)
+		require.NoError(t, err)
+
+		resp2, err := client.PostOAuth2ClientRegistration(ctx, req2)
+		require.NoError(t, err)
+
+		// Each client should only work with its own token
+		_, err = client.GetOAuth2ClientConfiguration(ctx, resp1.ClientID, resp1.RegistrationAccessToken)
+		require.NoError(t, err)
+
+		_, err = client.GetOAuth2ClientConfiguration(ctx, resp2.ClientID, resp2.RegistrationAccessToken)
+		require.NoError(t, err)
+
+		// Cross-client tokens should fail
+		_, err = client.GetOAuth2ClientConfiguration(ctx, resp1.ClientID, resp2.RegistrationAccessToken)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid_token")
+
+		_, err = client.GetOAuth2ClientConfiguration(ctx, resp2.ClientID, resp1.RegistrationAccessToken)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid_token")
+	})
+}
+
+// NOTE: OAuth2 client registration validation tests have been migrated to
+// oauth2provider/validation_test.go for better separation of concerns
diff --git a/coderd/oauth2provider/app_secrets.go b/coderd/oauth2provider/app_secrets.go
new file mode 100644
index 0000000000000..5549ece4266f2
--- /dev/null
+++ b/coderd/oauth2provider/app_secrets.go
@@ -0,0 +1,116 @@
+package oauth2provider
+
+import (
+	"net/http"
+
+	"github.com/google/uuid"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// GetAppSecrets returns an http.HandlerFunc that handles GET /oauth2-provider/apps/{app}/secrets
+func GetAppSecrets(db database.Store) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		app := httpmw.OAuth2ProviderApp(r)
+		dbSecrets, err := db.GetOAuth2ProviderAppSecretsByAppID(ctx, app.ID)
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error getting OAuth2 client secrets.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+		secrets := []codersdk.OAuth2ProviderAppSecret{}
+		for _, secret := range dbSecrets {
+			secrets = append(secrets, codersdk.OAuth2ProviderAppSecret{
+				ID:                    secret.ID,
+				LastUsedAt:            codersdk.NullTime{NullTime: secret.LastUsedAt},
+				ClientSecretTruncated: secret.DisplaySecret,
+			})
+		}
+		httpapi.Write(ctx, rw, http.StatusOK, secrets)
+	}
+}
+
+// CreateAppSecret returns an http.HandlerFunc that handles POST /oauth2-provider/apps/{app}/secrets
+func CreateAppSecret(db database.Store, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		var (
+			ctx               = r.Context()
+			app               = httpmw.OAuth2ProviderApp(r)
+			aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderAppSecret](rw, &audit.RequestParams{
+				Audit:   *auditor,
+				Log:     logger,
+				Request: r,
+				Action:  database.AuditActionCreate,
+			})
+		)
+		defer commitAudit()
+		secret, err := GenerateSecret()
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Failed to generate OAuth2 client secret.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+		dbSecret, err := db.InsertOAuth2ProviderAppSecret(ctx, database.InsertOAuth2ProviderAppSecretParams{
+			ID:           uuid.New(),
+			CreatedAt:    dbtime.Now(),
+			SecretPrefix: []byte(secret.Prefix),
+			HashedSecret: []byte(secret.Hashed),
+			// DisplaySecret is the last six characters of the original unhashed secret.
+			// This is done so they can be differentiated and it matches how GitHub
+			// displays their client secrets.
+			DisplaySecret: secret.Formatted[len(secret.Formatted)-6:],
+			AppID:         app.ID,
+		})
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error creating OAuth2 client secret.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+		aReq.New = dbSecret
+		httpapi.Write(ctx, rw, http.StatusCreated, codersdk.OAuth2ProviderAppSecretFull{
+			ID:               dbSecret.ID,
+			ClientSecretFull: secret.Formatted,
+		})
+	}
+}
+
+// DeleteAppSecret returns an http.HandlerFunc that handles DELETE /oauth2-provider/apps/{app}/secrets/{secretID}
+func DeleteAppSecret(db database.Store, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		var (
+			ctx               = r.Context()
+			secret            = httpmw.OAuth2ProviderAppSecret(r)
+			aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderAppSecret](rw, &audit.RequestParams{
+				Audit:   *auditor,
+				Log:     logger,
+				Request: r,
+				Action:  database.AuditActionDelete,
+			})
+		)
+		aReq.Old = secret
+		defer commitAudit()
+		err := db.DeleteOAuth2ProviderAppSecretByID(ctx, secret.ID)
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error deleting OAuth2 client secret.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+		rw.WriteHeader(http.StatusNoContent)
+	}
+}
diff --git a/coderd/oauth2provider/apps.go b/coderd/oauth2provider/apps.go
new file mode 100644
index 0000000000000..74bafb851ef1a
--- /dev/null
+++ b/coderd/oauth2provider/apps.go
@@ -0,0 +1,208 @@
+package oauth2provider
+
+import (
+	"database/sql"
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"github.com/google/uuid"
+	"github.com/sqlc-dev/pqtype"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// ListApps returns an http.HandlerFunc that handles GET /oauth2-provider/apps
+func ListApps(db database.Store, accessURL *url.URL) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+
+		rawUserID := r.URL.Query().Get("user_id")
+		if rawUserID == "" {
+			dbApps, err := db.GetOAuth2ProviderApps(ctx)
+			if err != nil {
+				httpapi.InternalServerError(rw, err)
+				return
+			}
+			httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApps(accessURL, dbApps))
+			return
+		}
+
+		userID, err := uuid.Parse(rawUserID)
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Invalid user UUID",
+				Detail:  fmt.Sprintf("queried user_id=%q", userID),
+			})
+			return
+		}
+
+		userApps, err := db.GetOAuth2ProviderAppsByUserID(ctx, userID)
+		if err != nil {
+			httpapi.InternalServerError(rw, err)
+			return
+		}
+
+		var sdkApps []codersdk.OAuth2ProviderApp
+		for _, app := range userApps {
+			sdkApps = append(sdkApps, db2sdk.OAuth2ProviderApp(accessURL, app.OAuth2ProviderApp))
+		}
+		httpapi.Write(ctx, rw, http.StatusOK, sdkApps)
+	}
+}
+
+// GetApp returns an http.HandlerFunc that handles GET /oauth2-provider/apps/{app}
+func GetApp(accessURL *url.URL) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		app := httpmw.OAuth2ProviderApp(r)
+		httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApp(accessURL, app))
+	}
+}
+
+// CreateApp returns an http.HandlerFunc that handles POST /oauth2-provider/apps
+func CreateApp(db database.Store, accessURL *url.URL, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		var (
+			ctx               = r.Context()
+			aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{
+				Audit:   *auditor,
+				Log:     logger,
+				Request: r,
+				Action:  database.AuditActionCreate,
+			})
+		)
+		defer commitAudit()
+		var req codersdk.PostOAuth2ProviderAppRequest
+		if !httpapi.Read(ctx, rw, r, &req) {
+			return
+		}
+		app, err := db.InsertOAuth2ProviderApp(ctx, database.InsertOAuth2ProviderAppParams{
+			ID:                      uuid.New(),
+			CreatedAt:               dbtime.Now(),
+			UpdatedAt:               dbtime.Now(),
+			Name:                    req.Name,
+			Icon:                    req.Icon,
+			CallbackURL:             req.CallbackURL,
+			RedirectUris:            []string{},
+			ClientType:              sql.NullString{String: "confidential", Valid: true},
+			DynamicallyRegistered:   sql.NullBool{Bool: false, Valid: true},
+			ClientIDIssuedAt:        sql.NullTime{},
+			ClientSecretExpiresAt:   sql.NullTime{},
+			GrantTypes:              []string{"authorization_code", "refresh_token"},
+			ResponseTypes:           []string{"code"},
+			TokenEndpointAuthMethod: sql.NullString{String: "client_secret_post", Valid: true},
+			Scope:                   sql.NullString{},
+			Contacts:                []string{},
+			ClientUri:               sql.NullString{},
+			LogoUri:                 sql.NullString{},
+			TosUri:                  sql.NullString{},
+			PolicyUri:               sql.NullString{},
+			JwksUri:                 sql.NullString{},
+			Jwks:                    pqtype.NullRawMessage{},
+			SoftwareID:              sql.NullString{},
+			SoftwareVersion:         sql.NullString{},
+			RegistrationAccessToken: sql.NullString{},
+			RegistrationClientUri:   sql.NullString{},
+		})
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error creating OAuth2 application.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+		aReq.New = app
+		httpapi.Write(ctx, rw, http.StatusCreated, db2sdk.OAuth2ProviderApp(accessURL, app))
+	}
+}
+
+// UpdateApp returns an http.HandlerFunc that handles PUT /oauth2-provider/apps/{app}
+func UpdateApp(db database.Store, accessURL *url.URL, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		var (
+			ctx               = r.Context()
+			app               = httpmw.OAuth2ProviderApp(r)
+			aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{
+				Audit:   *auditor,
+				Log:     logger,
+				Request: r,
+				Action:  database.AuditActionWrite,
+			})
+		)
+		aReq.Old = app
+		defer commitAudit()
+		var req codersdk.PutOAuth2ProviderAppRequest
+		if !httpapi.Read(ctx, rw, r, &req) {
+			return
+		}
+		app, err := db.UpdateOAuth2ProviderAppByID(ctx, database.UpdateOAuth2ProviderAppByIDParams{
+			ID:                      app.ID,
+			UpdatedAt:               dbtime.Now(),
+			Name:                    req.Name,
+			Icon:                    req.Icon,
+			CallbackURL:             req.CallbackURL,
+			RedirectUris:            app.RedirectUris,            // Keep existing value
+			ClientType:              app.ClientType,              // Keep existing value
+			DynamicallyRegistered:   app.DynamicallyRegistered,   // Keep existing value
+			ClientSecretExpiresAt:   app.ClientSecretExpiresAt,   // Keep existing value
+			GrantTypes:              app.GrantTypes,              // Keep existing value
+			ResponseTypes:           app.ResponseTypes,           // Keep existing value
+			TokenEndpointAuthMethod: app.TokenEndpointAuthMethod, // Keep existing value
+			Scope:                   app.Scope,                   // Keep existing value
+			Contacts:                app.Contacts,                // Keep existing value
+			ClientUri:               app.ClientUri,               // Keep existing value
+			LogoUri:                 app.LogoUri,                 // Keep existing value
+			TosUri:                  app.TosUri,                  // Keep existing value
+			PolicyUri:               app.PolicyUri,               // Keep existing value
+			JwksUri:                 app.JwksUri,                 // Keep existing value
+			Jwks:                    app.Jwks,                    // Keep existing value
+			SoftwareID:              app.SoftwareID,              // Keep existing value
+			SoftwareVersion:         app.SoftwareVersion,         // Keep existing value
+		})
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error updating OAuth2 application.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+		aReq.New = app
+		httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApp(accessURL, app))
+	}
+}
+
+// DeleteApp returns an http.HandlerFunc that handles DELETE /oauth2-provider/apps/{app}
+func DeleteApp(db database.Store, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		var (
+			ctx               = r.Context()
+			app               = httpmw.OAuth2ProviderApp(r)
+			aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{
+				Audit:   *auditor,
+				Log:     logger,
+				Request: r,
+				Action:  database.AuditActionDelete,
+			})
+		)
+		aReq.Old = app
+		defer commitAudit()
+		err := db.DeleteOAuth2ProviderAppByID(ctx, app.ID)
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error deleting OAuth2 application.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+		rw.WriteHeader(http.StatusNoContent)
+	}
+}
diff --git a/coderd/identityprovider/authorize.go b/coderd/oauth2provider/authorize.go
similarity index 99%
rename from coderd/identityprovider/authorize.go
rename to coderd/oauth2provider/authorize.go
index 3dcb511223e3b..77be5fc397a8a 100644
--- a/coderd/identityprovider/authorize.go
+++ b/coderd/oauth2provider/authorize.go
@@ -1,4 +1,4 @@
-package identityprovider
+package oauth2provider
 
 import (
 	"database/sql"
diff --git a/coderd/oauth2provider/metadata.go b/coderd/oauth2provider/metadata.go
new file mode 100644
index 0000000000000..9ce10f89933b7
--- /dev/null
+++ b/coderd/oauth2provider/metadata.go
@@ -0,0 +1,45 @@
+package oauth2provider
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// GetAuthorizationServerMetadata returns an http.HandlerFunc that handles GET /.well-known/oauth-authorization-server
+func GetAuthorizationServerMetadata(accessURL *url.URL) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		metadata := codersdk.OAuth2AuthorizationServerMetadata{
+			Issuer:                        accessURL.String(),
+			AuthorizationEndpoint:         accessURL.JoinPath("/oauth2/authorize").String(),
+			TokenEndpoint:                 accessURL.JoinPath("/oauth2/tokens").String(),
+			RegistrationEndpoint:          accessURL.JoinPath("/oauth2/register").String(), // RFC 7591
+			ResponseTypesSupported:        []string{"code"},
+			GrantTypesSupported:           []string{"authorization_code", "refresh_token"},
+			CodeChallengeMethodsSupported: []string{"S256"},
+			// TODO: Implement scope system
+			ScopesSupported:                   []string{},
+			TokenEndpointAuthMethodsSupported: []string{"client_secret_post"},
+		}
+		httpapi.Write(ctx, rw, http.StatusOK, metadata)
+	}
+}
+
+// GetProtectedResourceMetadata returns an http.HandlerFunc that handles GET /.well-known/oauth-protected-resource
+func GetProtectedResourceMetadata(accessURL *url.URL) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		metadata := codersdk.OAuth2ProtectedResourceMetadata{
+			Resource:             accessURL.String(),
+			AuthorizationServers: []string{accessURL.String()},
+			// TODO: Implement scope system based on RBAC permissions
+			ScopesSupported: []string{},
+			// RFC 6750 Bearer Token methods supported as fallback methods in api key middleware
+			BearerMethodsSupported: []string{"header", "query"},
+		}
+		httpapi.Write(ctx, rw, http.StatusOK, metadata)
+	}
+}
diff --git a/coderd/oauth2provider/metadata_test.go b/coderd/oauth2provider/metadata_test.go
new file mode 100644
index 0000000000000..067cb6e74f8c6
--- /dev/null
+++ b/coderd/oauth2provider/metadata_test.go
@@ -0,0 +1,86 @@
+package oauth2provider_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestOAuth2AuthorizationServerMetadata(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, nil)
+	serverURL := client.URL
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	// Use a plain HTTP client since this endpoint doesn't require authentication
+	endpoint := serverURL.ResolveReference(&url.URL{Path: "/.well-known/oauth-authorization-server"}).String()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	require.NoError(t, err)
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	var metadata codersdk.OAuth2AuthorizationServerMetadata
+	err = json.NewDecoder(resp.Body).Decode(&metadata)
+	require.NoError(t, err)
+
+	// Verify the metadata
+	require.NotEmpty(t, metadata.Issuer)
+	require.NotEmpty(t, metadata.AuthorizationEndpoint)
+	require.NotEmpty(t, metadata.TokenEndpoint)
+	require.Contains(t, metadata.ResponseTypesSupported, "code")
+	require.Contains(t, metadata.GrantTypesSupported, "authorization_code")
+	require.Contains(t, metadata.GrantTypesSupported, "refresh_token")
+	require.Contains(t, metadata.CodeChallengeMethodsSupported, "S256")
+}
+
+func TestOAuth2ProtectedResourceMetadata(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, nil)
+	serverURL := client.URL
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	// Use a plain HTTP client since this endpoint doesn't require authentication
+	endpoint := serverURL.ResolveReference(&url.URL{Path: "/.well-known/oauth-protected-resource"}).String()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	require.NoError(t, err)
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	var metadata codersdk.OAuth2ProtectedResourceMetadata
+	err = json.NewDecoder(resp.Body).Decode(&metadata)
+	require.NoError(t, err)
+
+	// Verify the metadata
+	require.NotEmpty(t, metadata.Resource)
+	require.NotEmpty(t, metadata.AuthorizationServers)
+	require.Len(t, metadata.AuthorizationServers, 1)
+	require.Equal(t, metadata.Resource, metadata.AuthorizationServers[0])
+	// RFC 6750 bearer tokens are now supported as fallback methods
+	require.Contains(t, metadata.BearerMethodsSupported, "header")
+	require.Contains(t, metadata.BearerMethodsSupported, "query")
+	// ScopesSupported can be empty until scope system is implemented
+	// Empty slice is marshaled as empty array, but can be nil when unmarshaled
+	require.True(t, len(metadata.ScopesSupported) == 0)
+}
diff --git a/coderd/identityprovider/middleware.go b/coderd/oauth2provider/middleware.go
similarity index 99%
rename from coderd/identityprovider/middleware.go
rename to coderd/oauth2provider/middleware.go
index 5b49bdd29fbcf..c989d068a821c 100644
--- a/coderd/identityprovider/middleware.go
+++ b/coderd/oauth2provider/middleware.go
@@ -1,4 +1,4 @@
-package identityprovider
+package oauth2provider
 
 import (
 	"net/http"
diff --git a/coderd/identityprovider/identityprovidertest/fixtures.go b/coderd/oauth2provider/oauth2providertest/fixtures.go
similarity index 97%
rename from coderd/identityprovider/identityprovidertest/fixtures.go
rename to coderd/oauth2provider/oauth2providertest/fixtures.go
index c5d4bf31cf7ff..8dbccb511a36c 100644
--- a/coderd/identityprovider/identityprovidertest/fixtures.go
+++ b/coderd/oauth2provider/oauth2providertest/fixtures.go
@@ -1,4 +1,4 @@
-package identityprovidertest
+package oauth2providertest
 
 import (
 	"crypto/sha256"
diff --git a/coderd/identityprovider/identityprovidertest/helpers.go b/coderd/oauth2provider/oauth2providertest/helpers.go
similarity index 98%
rename from coderd/identityprovider/identityprovidertest/helpers.go
rename to coderd/oauth2provider/oauth2providertest/helpers.go
index 7773a116a40f5..d0a90c6d34768 100644
--- a/coderd/identityprovider/identityprovidertest/helpers.go
+++ b/coderd/oauth2provider/oauth2providertest/helpers.go
@@ -1,7 +1,7 @@
-// Package identityprovidertest provides comprehensive testing utilities for OAuth2 identity provider functionality.
+// Package oauth2providertest provides comprehensive testing utilities for OAuth2 identity provider functionality.
 // It includes helpers for creating OAuth2 apps, performing authorization flows, token exchanges,
 // PKCE challenge generation and verification, and testing error scenarios.
-package identityprovidertest
+package oauth2providertest
 
 import (
 	"crypto/rand"
diff --git a/coderd/identityprovider/identityprovidertest/oauth2_test.go b/coderd/oauth2provider/oauth2providertest/oauth2_test.go
similarity index 60%
rename from coderd/identityprovider/identityprovidertest/oauth2_test.go
rename to coderd/oauth2provider/oauth2providertest/oauth2_test.go
index 28e7ae38a3866..cb33c8914a676 100644
--- a/coderd/identityprovider/identityprovidertest/oauth2_test.go
+++ b/coderd/oauth2provider/oauth2providertest/oauth2_test.go
@@ -1,4 +1,4 @@
-package identityprovidertest_test
+package oauth2providertest_test
 
 import (
 	"testing"
@@ -6,7 +6,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/coder/coder/v2/coderd/coderdtest"
-	"github.com/coder/coder/v2/coderd/identityprovider/identityprovidertest"
+	"github.com/coder/coder/v2/coderd/oauth2provider/oauth2providertest"
 )
 
 func TestOAuth2AuthorizationServerMetadata(t *testing.T) {
@@ -18,7 +18,7 @@ func TestOAuth2AuthorizationServerMetadata(t *testing.T) {
 	_ = coderdtest.CreateFirstUser(t, client)
 
 	// Fetch OAuth2 metadata
-	metadata := identityprovidertest.FetchOAuth2Metadata(t, client.URL.String())
+	metadata := oauth2providertest.FetchOAuth2Metadata(t, client.URL.String())
 
 	// Verify required metadata fields
 	require.Contains(t, metadata, "issuer", "missing issuer in metadata")
@@ -60,39 +60,39 @@ func TestOAuth2PKCEFlow(t *testing.T) {
 	_ = coderdtest.CreateFirstUser(t, client)
 
 	// Create OAuth2 app
-	app, clientSecret := identityprovidertest.CreateTestOAuth2App(t, client)
+	app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client)
 	t.Cleanup(func() {
-		identityprovidertest.CleanupOAuth2App(t, client, app.ID)
+		oauth2providertest.CleanupOAuth2App(t, client, app.ID)
 	})
 
 	// Generate PKCE parameters
-	codeVerifier, codeChallenge := identityprovidertest.GeneratePKCE(t)
-	state := identityprovidertest.GenerateState(t)
+	codeVerifier, codeChallenge := oauth2providertest.GeneratePKCE(t)
+	state := oauth2providertest.GenerateState(t)
 
 	// Perform authorization
-	authParams := identityprovidertest.AuthorizeParams{
+	authParams := oauth2providertest.AuthorizeParams{
 		ClientID:            app.ID.String(),
 		ResponseType:        "code",
-		RedirectURI:         identityprovidertest.TestRedirectURI,
+		RedirectURI:         oauth2providertest.TestRedirectURI,
 		State:               state,
 		CodeChallenge:       codeChallenge,
 		CodeChallengeMethod: "S256",
 	}
 
-	code := identityprovidertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams)
+	code := oauth2providertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams)
 	require.NotEmpty(t, code, "should receive authorization code")
 
 	// Exchange code for token with PKCE
-	tokenParams := identityprovidertest.TokenExchangeParams{
+	tokenParams := oauth2providertest.TokenExchangeParams{
 		GrantType:    "authorization_code",
 		Code:         code,
 		ClientID:     app.ID.String(),
 		ClientSecret: clientSecret,
 		CodeVerifier: codeVerifier,
-		RedirectURI:  identityprovidertest.TestRedirectURI,
+		RedirectURI:  oauth2providertest.TestRedirectURI,
 	}
 
-	token := identityprovidertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams)
+	token := oauth2providertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams)
 	require.NotEmpty(t, token.AccessToken, "should receive access token")
 	require.NotEmpty(t, token.RefreshToken, "should receive refresh token")
 	require.Equal(t, "Bearer", token.TokenType, "token type should be Bearer")
@@ -107,40 +107,40 @@ func TestOAuth2InvalidPKCE(t *testing.T) {
 	_ = coderdtest.CreateFirstUser(t, client)
 
 	// Create OAuth2 app
-	app, clientSecret := identityprovidertest.CreateTestOAuth2App(t, client)
+	app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client)
 	t.Cleanup(func() {
-		identityprovidertest.CleanupOAuth2App(t, client, app.ID)
+		oauth2providertest.CleanupOAuth2App(t, client, app.ID)
 	})
 
 	// Generate PKCE parameters
-	_, codeChallenge := identityprovidertest.GeneratePKCE(t)
-	state := identityprovidertest.GenerateState(t)
+	_, codeChallenge := oauth2providertest.GeneratePKCE(t)
+	state := oauth2providertest.GenerateState(t)
 
 	// Perform authorization
-	authParams := identityprovidertest.AuthorizeParams{
+	authParams := oauth2providertest.AuthorizeParams{
 		ClientID:            app.ID.String(),
 		ResponseType:        "code",
-		RedirectURI:         identityprovidertest.TestRedirectURI,
+		RedirectURI:         oauth2providertest.TestRedirectURI,
 		State:               state,
 		CodeChallenge:       codeChallenge,
 		CodeChallengeMethod: "S256",
 	}
 
-	code := identityprovidertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams)
+	code := oauth2providertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams)
 	require.NotEmpty(t, code, "should receive authorization code")
 
 	// Attempt token exchange with wrong code verifier
-	tokenParams := identityprovidertest.TokenExchangeParams{
+	tokenParams := oauth2providertest.TokenExchangeParams{
 		GrantType:    "authorization_code",
 		Code:         code,
 		ClientID:     app.ID.String(),
 		ClientSecret: clientSecret,
-		CodeVerifier: identityprovidertest.InvalidCodeVerifier,
-		RedirectURI:  identityprovidertest.TestRedirectURI,
+		CodeVerifier: oauth2providertest.InvalidCodeVerifier,
+		RedirectURI:  oauth2providertest.TestRedirectURI,
 	}
 
-	identityprovidertest.PerformTokenExchangeExpectingError(
-		t, client.URL.String(), tokenParams, identityprovidertest.OAuth2ErrorTypes.InvalidGrant,
+	oauth2providertest.PerformTokenExchangeExpectingError(
+		t, client.URL.String(), tokenParams, oauth2providertest.OAuth2ErrorTypes.InvalidGrant,
 	)
 }
 
@@ -153,34 +153,34 @@ func TestOAuth2WithoutPKCE(t *testing.T) {
 	_ = coderdtest.CreateFirstUser(t, client)
 
 	// Create OAuth2 app
-	app, clientSecret := identityprovidertest.CreateTestOAuth2App(t, client)
+	app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client)
 	t.Cleanup(func() {
-		identityprovidertest.CleanupOAuth2App(t, client, app.ID)
+		oauth2providertest.CleanupOAuth2App(t, client, app.ID)
 	})
 
-	state := identityprovidertest.GenerateState(t)
+	state := oauth2providertest.GenerateState(t)
 
 	// Perform authorization without PKCE
-	authParams := identityprovidertest.AuthorizeParams{
+	authParams := oauth2providertest.AuthorizeParams{
 		ClientID:     app.ID.String(),
 		ResponseType: "code",
-		RedirectURI:  identityprovidertest.TestRedirectURI,
+		RedirectURI:  oauth2providertest.TestRedirectURI,
 		State:        state,
 	}
 
-	code := identityprovidertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams)
+	code := oauth2providertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams)
 	require.NotEmpty(t, code, "should receive authorization code")
 
 	// Exchange code for token without PKCE
-	tokenParams := identityprovidertest.TokenExchangeParams{
+	tokenParams := oauth2providertest.TokenExchangeParams{
 		GrantType:    "authorization_code",
 		Code:         code,
 		ClientID:     app.ID.String(),
 		ClientSecret: clientSecret,
-		RedirectURI:  identityprovidertest.TestRedirectURI,
+		RedirectURI:  oauth2providertest.TestRedirectURI,
 	}
 
-	token := identityprovidertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams)
+	token := oauth2providertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams)
 	require.NotEmpty(t, token.AccessToken, "should receive access token")
 	require.NotEmpty(t, token.RefreshToken, "should receive refresh token")
 }
@@ -194,36 +194,36 @@ func TestOAuth2ResourceParameter(t *testing.T) {
 	_ = coderdtest.CreateFirstUser(t, client)
 
 	// Create OAuth2 app
-	app, clientSecret := identityprovidertest.CreateTestOAuth2App(t, client)
+	app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client)
 	t.Cleanup(func() {
-		identityprovidertest.CleanupOAuth2App(t, client, app.ID)
+		oauth2providertest.CleanupOAuth2App(t, client, app.ID)
 	})
 
-	state := identityprovidertest.GenerateState(t)
+	state := oauth2providertest.GenerateState(t)
 
 	// Perform authorization with resource parameter
-	authParams := identityprovidertest.AuthorizeParams{
+	authParams := oauth2providertest.AuthorizeParams{
 		ClientID:     app.ID.String(),
 		ResponseType: "code",
-		RedirectURI:  identityprovidertest.TestRedirectURI,
+		RedirectURI:  oauth2providertest.TestRedirectURI,
 		State:        state,
-		Resource:     identityprovidertest.TestResourceURI,
+		Resource:     oauth2providertest.TestResourceURI,
 	}
 
-	code := identityprovidertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams)
+	code := oauth2providertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams)
 	require.NotEmpty(t, code, "should receive authorization code")
 
 	// Exchange code for token with resource parameter
-	tokenParams := identityprovidertest.TokenExchangeParams{
+	tokenParams := oauth2providertest.TokenExchangeParams{
 		GrantType:    "authorization_code",
 		Code:         code,
 		ClientID:     app.ID.String(),
 		ClientSecret: clientSecret,
-		RedirectURI:  identityprovidertest.TestRedirectURI,
-		Resource:     identityprovidertest.TestResourceURI,
+		RedirectURI:  oauth2providertest.TestRedirectURI,
+		Resource:     oauth2providertest.TestResourceURI,
 	}
 
-	token := identityprovidertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams)
+	token := oauth2providertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams)
 	require.NotEmpty(t, token.AccessToken, "should receive access token")
 	require.NotEmpty(t, token.RefreshToken, "should receive refresh token")
 }
@@ -237,43 +237,43 @@ func TestOAuth2TokenRefresh(t *testing.T) {
 	_ = coderdtest.CreateFirstUser(t, client)
 
 	// Create OAuth2 app
-	app, clientSecret := identityprovidertest.CreateTestOAuth2App(t, client)
+	app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client)
 	t.Cleanup(func() {
-		identityprovidertest.CleanupOAuth2App(t, client, app.ID)
+		oauth2providertest.CleanupOAuth2App(t, client, app.ID)
 	})
 
-	state := identityprovidertest.GenerateState(t)
+	state := oauth2providertest.GenerateState(t)
 
 	// Get initial token
-	authParams := identityprovidertest.AuthorizeParams{
+	authParams := oauth2providertest.AuthorizeParams{
 		ClientID:     app.ID.String(),
 		ResponseType: "code",
-		RedirectURI:  identityprovidertest.TestRedirectURI,
+		RedirectURI:  oauth2providertest.TestRedirectURI,
 		State:        state,
 	}
 
-	code := identityprovidertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams)
+	code := oauth2providertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams)
 
-	tokenParams := identityprovidertest.TokenExchangeParams{
+	tokenParams := oauth2providertest.TokenExchangeParams{
 		GrantType:    "authorization_code",
 		Code:         code,
 		ClientID:     app.ID.String(),
 		ClientSecret: clientSecret,
-		RedirectURI:  identityprovidertest.TestRedirectURI,
+		RedirectURI:  oauth2providertest.TestRedirectURI,
 	}
 
-	initialToken := identityprovidertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams)
+	initialToken := oauth2providertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams)
 	require.NotEmpty(t, initialToken.RefreshToken, "should receive refresh token")
 
 	// Use refresh token to get new access token
-	refreshParams := identityprovidertest.TokenExchangeParams{
+	refreshParams := oauth2providertest.TokenExchangeParams{
 		GrantType:    "refresh_token",
 		RefreshToken: initialToken.RefreshToken,
 		ClientID:     app.ID.String(),
 		ClientSecret: clientSecret,
 	}
 
-	refreshedToken := identityprovidertest.ExchangeCodeForToken(t, client.URL.String(), refreshParams)
+	refreshedToken := oauth2providertest.ExchangeCodeForToken(t, client.URL.String(), refreshParams)
 	require.NotEmpty(t, refreshedToken.AccessToken, "should receive new access token")
 	require.NotEqual(t, initialToken.AccessToken, refreshedToken.AccessToken, "new access token should be different")
 }
@@ -289,53 +289,53 @@ func TestOAuth2ErrorResponses(t *testing.T) {
 	t.Run("InvalidClient", func(t *testing.T) {
 		t.Parallel()
 
-		tokenParams := identityprovidertest.TokenExchangeParams{
+		tokenParams := oauth2providertest.TokenExchangeParams{
 			GrantType:    "authorization_code",
 			Code:         "invalid-code",
 			ClientID:     "non-existent-client",
 			ClientSecret: "invalid-secret",
 		}
 
-		identityprovidertest.PerformTokenExchangeExpectingError(
-			t, client.URL.String(), tokenParams, identityprovidertest.OAuth2ErrorTypes.InvalidClient,
+		oauth2providertest.PerformTokenExchangeExpectingError(
+			t, client.URL.String(), tokenParams, oauth2providertest.OAuth2ErrorTypes.InvalidClient,
 		)
 	})
 
 	t.Run("InvalidGrantType", func(t *testing.T) {
 		t.Parallel()
 
-		app, clientSecret := identityprovidertest.CreateTestOAuth2App(t, client)
+		app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client)
 		t.Cleanup(func() {
-			identityprovidertest.CleanupOAuth2App(t, client, app.ID)
+			oauth2providertest.CleanupOAuth2App(t, client, app.ID)
 		})
 
-		tokenParams := identityprovidertest.TokenExchangeParams{
+		tokenParams := oauth2providertest.TokenExchangeParams{
 			GrantType:    "invalid_grant_type",
 			ClientID:     app.ID.String(),
 			ClientSecret: clientSecret,
 		}
 
-		identityprovidertest.PerformTokenExchangeExpectingError(
-			t, client.URL.String(), tokenParams, identityprovidertest.OAuth2ErrorTypes.UnsupportedGrantType,
+		oauth2providertest.PerformTokenExchangeExpectingError(
+			t, client.URL.String(), tokenParams, oauth2providertest.OAuth2ErrorTypes.UnsupportedGrantType,
 		)
 	})
 
 	t.Run("MissingCode", func(t *testing.T) {
 		t.Parallel()
 
-		app, clientSecret := identityprovidertest.CreateTestOAuth2App(t, client)
+		app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client)
 		t.Cleanup(func() {
-			identityprovidertest.CleanupOAuth2App(t, client, app.ID)
+			oauth2providertest.CleanupOAuth2App(t, client, app.ID)
 		})
 
-		tokenParams := identityprovidertest.TokenExchangeParams{
+		tokenParams := oauth2providertest.TokenExchangeParams{
 			GrantType:    "authorization_code",
 			ClientID:     app.ID.String(),
 			ClientSecret: clientSecret,
 		}
 
-		identityprovidertest.PerformTokenExchangeExpectingError(
-			t, client.URL.String(), tokenParams, identityprovidertest.OAuth2ErrorTypes.InvalidRequest,
+		oauth2providertest.PerformTokenExchangeExpectingError(
+			t, client.URL.String(), tokenParams, oauth2providertest.OAuth2ErrorTypes.InvalidRequest,
 		)
 	})
 }
diff --git a/coderd/identityprovider/pkce.go b/coderd/oauth2provider/pkce.go
similarity index 95%
rename from coderd/identityprovider/pkce.go
rename to coderd/oauth2provider/pkce.go
index 08e4014077bc0..fd759dff88935 100644
--- a/coderd/identityprovider/pkce.go
+++ b/coderd/oauth2provider/pkce.go
@@ -1,4 +1,4 @@
-package identityprovider
+package oauth2provider
 
 import (
 	"crypto/sha256"
diff --git a/coderd/identityprovider/pkce_test.go b/coderd/oauth2provider/pkce_test.go
similarity index 88%
rename from coderd/identityprovider/pkce_test.go
rename to coderd/oauth2provider/pkce_test.go
index 8cd8e1c8f47f2..f0ed74ca1b6b9 100644
--- a/coderd/identityprovider/pkce_test.go
+++ b/coderd/oauth2provider/pkce_test.go
@@ -1,4 +1,4 @@
-package identityprovider_test
+package oauth2provider_test
 
 import (
 	"crypto/sha256"
@@ -7,7 +7,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/v2/coderd/identityprovider"
+	"github.com/coder/coder/v2/coderd/oauth2provider"
 )
 
 func TestVerifyPKCE(t *testing.T) {
@@ -55,7 +55,7 @@ func TestVerifyPKCE(t *testing.T) {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			result := identityprovider.VerifyPKCE(tt.challenge, tt.verifier)
+			result := oauth2provider.VerifyPKCE(tt.challenge, tt.verifier)
 			require.Equal(t, tt.expectValid, result)
 		})
 	}
@@ -73,5 +73,5 @@ func TestPKCES256Generation(t *testing.T) {
 	challenge := base64.RawURLEncoding.EncodeToString(h[:])
 
 	require.Equal(t, expectedChallenge, challenge)
-	require.True(t, identityprovider.VerifyPKCE(challenge, verifier))
+	require.True(t, oauth2provider.VerifyPKCE(challenge, verifier))
 }
diff --git a/coderd/oauth2provider/provider_test.go b/coderd/oauth2provider/provider_test.go
new file mode 100644
index 0000000000000..572b3f6dafd11
--- /dev/null
+++ b/coderd/oauth2provider/provider_test.go
@@ -0,0 +1,453 @@
+package oauth2provider_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
+)
+
+// TestOAuth2ProviderAppValidation tests validation logic for OAuth2 provider app requests
+func TestOAuth2ProviderAppValidation(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ValidationErrors", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name string
+			req  codersdk.PostOAuth2ProviderAppRequest
+		}{
+			{
+				name: "NameMissing",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					CallbackURL: "http://localhost:3000",
+				},
+			},
+			{
+				name: "NameSpaces",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo bar",
+					CallbackURL: "http://localhost:3000",
+				},
+			},
+			{
+				name: "NameTooLong",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "too loooooooooooooooooooooooooong",
+					CallbackURL: "http://localhost:3000",
+				},
+			},
+			{
+				name: "URLMissing",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name: "foo",
+				},
+			},
+			{
+				name: "URLLocalhostNoScheme",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "localhost:3000",
+				},
+			},
+			{
+				name: "URLNoScheme",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "coder.com",
+				},
+			},
+			{
+				name: "URLNoColon",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "http//coder",
+				},
+			},
+			{
+				name: "URLJustBar",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "bar",
+				},
+			},
+			{
+				name: "URLPathOnly",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "/bar/baz/qux",
+				},
+			},
+			{
+				name: "URLJustHttp",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "http",
+				},
+			},
+			{
+				name: "URLNoHost",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "http://",
+				},
+			},
+			{
+				name: "URLSpaces",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "bar baz qux",
+				},
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				testCtx := testutil.Context(t, testutil.WaitLong)
+
+				//nolint:gocritic // OAuth2 app management requires owner permission.
+				_, err := client.PostOAuth2ProviderApp(testCtx, test.req)
+				require.Error(t, err)
+			})
+		}
+	})
+
+	t.Run("DuplicateNames", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Create multiple OAuth2 apps with the same name to verify RFC 7591 compliance
+		// RFC 7591 allows multiple apps to have the same name
+		appName := fmt.Sprintf("duplicate-name-%d", time.Now().UnixNano()%1000000)
+
+		// Create first app
+		//nolint:gocritic // OAuth2 app management requires owner permission.
+		app1, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{
+			Name:        appName,
+			CallbackURL: "http://localhost:3001",
+		})
+		require.NoError(t, err)
+		require.Equal(t, appName, app1.Name)
+
+		// Create second app with the same name
+		//nolint:gocritic // OAuth2 app management requires owner permission.
+		app2, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{
+			Name:        appName,
+			CallbackURL: "http://localhost:3002",
+		})
+		require.NoError(t, err)
+		require.Equal(t, appName, app2.Name)
+
+		// Create third app with the same name
+		//nolint:gocritic // OAuth2 app management requires owner permission.
+		app3, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{
+			Name:        appName,
+			CallbackURL: "http://localhost:3003",
+		})
+		require.NoError(t, err)
+		require.Equal(t, appName, app3.Name)
+
+		// Verify all apps have different IDs but same name
+		require.NotEqual(t, app1.ID, app2.ID)
+		require.NotEqual(t, app1.ID, app3.ID)
+		require.NotEqual(t, app2.ID, app3.ID)
+	})
+}
+
+// TestOAuth2ClientRegistrationValidation tests OAuth2 client registration validation
+func TestOAuth2ClientRegistrationValidation(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ValidURIs", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		validURIs := []string{
+			"https://example.com/callback",
+			"http://localhost:8080/callback",
+			"custom-scheme://app/callback",
+		}
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: validURIs,
+			ClientName:   fmt.Sprintf("valid-uris-client-%d", time.Now().UnixNano()),
+		}
+
+		resp, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+		require.Equal(t, validURIs, resp.RedirectURIs)
+	})
+
+	t.Run("InvalidURIs", func(t *testing.T) {
+		t.Parallel()
+
+		testCases := []struct {
+			name string
+			uris []string
+		}{
+			{
+				name: "InvalidURL",
+				uris: []string{"not-a-url"},
+			},
+			{
+				name: "EmptyFragment",
+				uris: []string{"https://example.com/callback#"},
+			},
+			{
+				name: "Fragment",
+				uris: []string{"https://example.com/callback#fragment"},
+			},
+		}
+
+		for _, tc := range testCases {
+			tc := tc
+			t.Run(tc.name, func(t *testing.T) {
+				t.Parallel()
+
+				// Create new client for each sub-test to avoid shared state issues
+				subClient := coderdtest.New(t, nil)
+				_ = coderdtest.CreateFirstUser(t, subClient)
+				subCtx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs: tc.uris,
+					ClientName:   fmt.Sprintf("invalid-uri-client-%s-%d", tc.name, time.Now().UnixNano()),
+				}
+
+				_, err := subClient.PostOAuth2ClientRegistration(subCtx, req)
+				require.Error(t, err)
+				require.Contains(t, err.Error(), "invalid_client_metadata")
+			})
+		}
+	})
+
+	t.Run("ValidGrantTypes", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/callback"},
+			ClientName:   fmt.Sprintf("valid-grant-types-client-%d", time.Now().UnixNano()),
+			GrantTypes:   []string{"authorization_code", "refresh_token"},
+		}
+
+		resp, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+		require.Equal(t, req.GrantTypes, resp.GrantTypes)
+	})
+
+	t.Run("InvalidGrantTypes", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/callback"},
+			ClientName:   fmt.Sprintf("invalid-grant-types-client-%d", time.Now().UnixNano()),
+			GrantTypes:   []string{"unsupported_grant"},
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid_client_metadata")
+	})
+
+	t.Run("ValidResponseTypes", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs:  []string{"https://example.com/callback"},
+			ClientName:    fmt.Sprintf("valid-response-types-client-%d", time.Now().UnixNano()),
+			ResponseTypes: []string{"code"},
+		}
+
+		resp, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+		require.Equal(t, req.ResponseTypes, resp.ResponseTypes)
+	})
+
+	t.Run("InvalidResponseTypes", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs:  []string{"https://example.com/callback"},
+			ClientName:    fmt.Sprintf("invalid-response-types-client-%d", time.Now().UnixNano()),
+			ResponseTypes: []string{"token"}, // Not supported
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid_client_metadata")
+	})
+}
+
+// TestOAuth2ProviderAppOperations tests basic CRUD operations for OAuth2 provider apps
+func TestOAuth2ProviderAppOperations(t *testing.T) {
+	t.Parallel()
+
+	t.Run("DeleteNonExisting", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		owner := coderdtest.CreateFirstUser(t, client)
+		another, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		_, err := another.OAuth2ProviderApp(ctx, uuid.New())
+		require.Error(t, err)
+	})
+
+	t.Run("BasicOperations", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		owner := coderdtest.CreateFirstUser(t, client)
+		another, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// No apps yet.
+		apps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{})
+		require.NoError(t, err)
+		require.Len(t, apps, 0)
+
+		// Should be able to add apps.
+		expectedApps := generateApps(ctx, t, client, "get-apps")
+		expectedOrder := []codersdk.OAuth2ProviderApp{
+			expectedApps.Default, expectedApps.NoPort,
+			expectedApps.Extra[0], expectedApps.Extra[1], expectedApps.Subdomain,
+		}
+
+		// Should get all the apps now.
+		apps, err = another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{})
+		require.NoError(t, err)
+		require.Len(t, apps, 5)
+		require.Equal(t, expectedOrder, apps)
+
+		// Should be able to keep the same name when updating.
+		req := codersdk.PutOAuth2ProviderAppRequest{
+			Name:        expectedApps.Default.Name,
+			CallbackURL: "http://coder.com",
+			Icon:        "test",
+		}
+		//nolint:gocritic // OAuth2 app management requires owner permission.
+		newApp, err := client.PutOAuth2ProviderApp(ctx, expectedApps.Default.ID, req)
+		require.NoError(t, err)
+		require.Equal(t, req.Name, newApp.Name)
+		require.Equal(t, req.CallbackURL, newApp.CallbackURL)
+		require.Equal(t, req.Icon, newApp.Icon)
+		require.Equal(t, expectedApps.Default.ID, newApp.ID)
+
+		// Should be able to update name.
+		req = codersdk.PutOAuth2ProviderAppRequest{
+			Name:        "new-foo",
+			CallbackURL: "http://coder.com",
+			Icon:        "test",
+		}
+		//nolint:gocritic // OAuth2 app management requires owner permission.
+		newApp, err = client.PutOAuth2ProviderApp(ctx, expectedApps.Default.ID, req)
+		require.NoError(t, err)
+		require.Equal(t, req.Name, newApp.Name)
+		require.Equal(t, req.CallbackURL, newApp.CallbackURL)
+		require.Equal(t, req.Icon, newApp.Icon)
+		require.Equal(t, expectedApps.Default.ID, newApp.ID)
+
+		// Should be able to get a single app.
+		got, err := another.OAuth2ProviderApp(ctx, expectedApps.Default.ID)
+		require.NoError(t, err)
+		require.Equal(t, newApp, got)
+
+		// Should be able to delete an app.
+		//nolint:gocritic // OAuth2 app management requires owner permission.
+		err = client.DeleteOAuth2ProviderApp(ctx, expectedApps.Default.ID)
+		require.NoError(t, err)
+
+		// Should show the new count.
+		newApps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{})
+		require.NoError(t, err)
+		require.Len(t, newApps, 4)
+
+		require.Equal(t, expectedOrder[1:], newApps)
+	})
+
+	t.Run("ByUser", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, nil)
+		owner := coderdtest.CreateFirstUser(t, client)
+		another, user := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		ctx := testutil.Context(t, testutil.WaitLong)
+		_ = generateApps(ctx, t, client, "by-user")
+		apps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{
+			UserID: user.ID,
+		})
+		require.NoError(t, err)
+		require.Len(t, apps, 0)
+	})
+}
+
+// Helper functions
+
+type provisionedApps struct {
+	Default   codersdk.OAuth2ProviderApp
+	NoPort    codersdk.OAuth2ProviderApp
+	Subdomain codersdk.OAuth2ProviderApp
+	// For sorting purposes these are included. You will likely never touch them.
+	Extra []codersdk.OAuth2ProviderApp
+}
+
+func generateApps(ctx context.Context, t *testing.T, client *codersdk.Client, suffix string) provisionedApps {
+	create := func(name, callback string) codersdk.OAuth2ProviderApp {
+		name = fmt.Sprintf("%s-%s", name, suffix)
+		//nolint:gocritic // OAuth2 app management requires owner permission.
+		app, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{
+			Name:        name,
+			CallbackURL: callback,
+			Icon:        "",
+		})
+		require.NoError(t, err)
+		require.Equal(t, name, app.Name)
+		require.Equal(t, callback, app.CallbackURL)
+		return app
+	}
+
+	return provisionedApps{
+		Default:   create("app-a", "http://localhost1:8080/foo/bar"),
+		NoPort:    create("app-b", "http://localhost2"),
+		Subdomain: create("app-z", "http://30.localhost:3000"),
+		Extra: []codersdk.OAuth2ProviderApp{
+			create("app-x", "http://20.localhost:3000"),
+			create("app-y", "http://10.localhost:3000"),
+		},
+	}
+}
diff --git a/coderd/oauth2provider/registration.go b/coderd/oauth2provider/registration.go
new file mode 100644
index 0000000000000..63d2de4f48394
--- /dev/null
+++ b/coderd/oauth2provider/registration.go
@@ -0,0 +1,584 @@
+package oauth2provider
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/sqlc-dev/pqtype"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/userpassword"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+)
+
+// Constants for OAuth2 secret generation (RFC 7591)
+const (
+	secretLength        = 40 // Length of the actual secret part
+	displaySecretLength = 6  // Length of visible part in UI (last 6 characters)
+)
+
+// CreateDynamicClientRegistration returns an http.HandlerFunc that handles POST /oauth2/register
+func CreateDynamicClientRegistration(db database.Store, accessURL *url.URL, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		aReq, commitAudit := audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{
+			Audit:   *auditor,
+			Log:     logger,
+			Request: r,
+			Action:  database.AuditActionCreate,
+		})
+		defer commitAudit()
+
+		// Parse request
+		var req codersdk.OAuth2ClientRegistrationRequest
+		if !httpapi.Read(ctx, rw, r, &req) {
+			return
+		}
+
+		// Validate request
+		if err := req.Validate(); err != nil {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest,
+				"invalid_client_metadata", err.Error())
+			return
+		}
+
+		// Apply defaults
+		req = req.ApplyDefaults()
+
+		// Generate client credentials
+		clientID := uuid.New()
+		clientSecret, hashedSecret, err := generateClientCredentials()
+		if err != nil {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+				"server_error", "Failed to generate client credentials")
+			return
+		}
+
+		// Generate registration access token for RFC 7592 management
+		registrationToken, hashedRegToken, err := generateRegistrationAccessToken()
+		if err != nil {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+				"server_error", "Failed to generate registration token")
+			return
+		}
+
+		// Store in database - use system context since this is a public endpoint
+		now := dbtime.Now()
+		clientName := req.GenerateClientName()
+		//nolint:gocritic // Dynamic client registration is a public endpoint, system access required
+		app, err := db.InsertOAuth2ProviderApp(dbauthz.AsSystemRestricted(ctx), database.InsertOAuth2ProviderAppParams{
+			ID:                      clientID,
+			CreatedAt:               now,
+			UpdatedAt:               now,
+			Name:                    clientName,
+			Icon:                    req.LogoURI,
+			CallbackURL:             req.RedirectURIs[0], // Primary redirect URI
+			RedirectUris:            req.RedirectURIs,
+			ClientType:              sql.NullString{String: req.DetermineClientType(), Valid: true},
+			DynamicallyRegistered:   sql.NullBool{Bool: true, Valid: true},
+			ClientIDIssuedAt:        sql.NullTime{Time: now, Valid: true},
+			ClientSecretExpiresAt:   sql.NullTime{}, // No expiration for now
+			GrantTypes:              req.GrantTypes,
+			ResponseTypes:           req.ResponseTypes,
+			TokenEndpointAuthMethod: sql.NullString{String: req.TokenEndpointAuthMethod, Valid: true},
+			Scope:                   sql.NullString{String: req.Scope, Valid: true},
+			Contacts:                req.Contacts,
+			ClientUri:               sql.NullString{String: req.ClientURI, Valid: req.ClientURI != ""},
+			LogoUri:                 sql.NullString{String: req.LogoURI, Valid: req.LogoURI != ""},
+			TosUri:                  sql.NullString{String: req.TOSURI, Valid: req.TOSURI != ""},
+			PolicyUri:               sql.NullString{String: req.PolicyURI, Valid: req.PolicyURI != ""},
+			JwksUri:                 sql.NullString{String: req.JWKSURI, Valid: req.JWKSURI != ""},
+			Jwks:                    pqtype.NullRawMessage{RawMessage: req.JWKS, Valid: len(req.JWKS) > 0},
+			SoftwareID:              sql.NullString{String: req.SoftwareID, Valid: req.SoftwareID != ""},
+			SoftwareVersion:         sql.NullString{String: req.SoftwareVersion, Valid: req.SoftwareVersion != ""},
+			RegistrationAccessToken: sql.NullString{String: hashedRegToken, Valid: true},
+			RegistrationClientUri:   sql.NullString{String: fmt.Sprintf("%s/oauth2/clients/%s", accessURL.String(), clientID), Valid: true},
+		})
+		if err != nil {
+			logger.Error(ctx, "failed to store oauth2 client registration",
+				slog.Error(err),
+				slog.F("client_name", clientName),
+				slog.F("client_id", clientID.String()),
+				slog.F("redirect_uris", req.RedirectURIs))
+			writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+				"server_error", "Failed to store client registration")
+			return
+		}
+
+		// Create client secret - parse the formatted secret to get components
+		parsedSecret, err := parseFormattedSecret(clientSecret)
+		if err != nil {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+				"server_error", "Failed to parse generated secret")
+			return
+		}
+
+		//nolint:gocritic // Dynamic client registration is a public endpoint, system access required
+		_, err = db.InsertOAuth2ProviderAppSecret(dbauthz.AsSystemRestricted(ctx), database.InsertOAuth2ProviderAppSecretParams{
+			ID:            uuid.New(),
+			CreatedAt:     now,
+			SecretPrefix:  []byte(parsedSecret.prefix),
+			HashedSecret:  []byte(hashedSecret),
+			DisplaySecret: createDisplaySecret(clientSecret),
+			AppID:         clientID,
+		})
+		if err != nil {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+				"server_error", "Failed to store client secret")
+			return
+		}
+
+		// Set audit log data
+		aReq.New = app
+
+		// Return response
+		response := codersdk.OAuth2ClientRegistrationResponse{
+			ClientID:                app.ID.String(),
+			ClientSecret:            clientSecret,
+			ClientIDIssuedAt:        app.ClientIDIssuedAt.Time.Unix(),
+			ClientSecretExpiresAt:   0, // No expiration
+			RedirectURIs:            app.RedirectUris,
+			ClientName:              app.Name,
+			ClientURI:               app.ClientUri.String,
+			LogoURI:                 app.LogoUri.String,
+			TOSURI:                  app.TosUri.String,
+			PolicyURI:               app.PolicyUri.String,
+			JWKSURI:                 app.JwksUri.String,
+			JWKS:                    app.Jwks.RawMessage,
+			SoftwareID:              app.SoftwareID.String,
+			SoftwareVersion:         app.SoftwareVersion.String,
+			GrantTypes:              app.GrantTypes,
+			ResponseTypes:           app.ResponseTypes,
+			TokenEndpointAuthMethod: app.TokenEndpointAuthMethod.String,
+			Scope:                   app.Scope.String,
+			Contacts:                app.Contacts,
+			RegistrationAccessToken: registrationToken,
+			RegistrationClientURI:   app.RegistrationClientUri.String,
+		}
+
+		httpapi.Write(ctx, rw, http.StatusCreated, response)
+	}
+}
+
+// GetClientConfiguration returns an http.HandlerFunc that handles GET /oauth2/clients/{client_id}
+func GetClientConfiguration(db database.Store) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+
+		// Extract client ID from URL path
+		clientIDStr := chi.URLParam(r, "client_id")
+		clientID, err := uuid.Parse(clientIDStr)
+		if err != nil {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest,
+				"invalid_client_metadata", "Invalid client ID format")
+			return
+		}
+
+		// Get app by client ID
+		//nolint:gocritic // RFC 7592 endpoints need system access to retrieve dynamically registered clients
+		app, err := db.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID)
+		if err != nil {
+			if xerrors.Is(err, sql.ErrNoRows) {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
+					"invalid_token", "Client not found")
+			} else {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+					"server_error", "Failed to retrieve client")
+			}
+			return
+		}
+
+		// Check if client was dynamically registered
+		if !app.DynamicallyRegistered.Bool {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
+				"invalid_token", "Client was not dynamically registered")
+			return
+		}
+
+		// Return client configuration (without client_secret for security)
+		response := codersdk.OAuth2ClientConfiguration{
+			ClientID:                app.ID.String(),
+			ClientIDIssuedAt:        app.ClientIDIssuedAt.Time.Unix(),
+			ClientSecretExpiresAt:   0, // No expiration for now
+			RedirectURIs:            app.RedirectUris,
+			ClientName:              app.Name,
+			ClientURI:               app.ClientUri.String,
+			LogoURI:                 app.LogoUri.String,
+			TOSURI:                  app.TosUri.String,
+			PolicyURI:               app.PolicyUri.String,
+			JWKSURI:                 app.JwksUri.String,
+			JWKS:                    app.Jwks.RawMessage,
+			SoftwareID:              app.SoftwareID.String,
+			SoftwareVersion:         app.SoftwareVersion.String,
+			GrantTypes:              app.GrantTypes,
+			ResponseTypes:           app.ResponseTypes,
+			TokenEndpointAuthMethod: app.TokenEndpointAuthMethod.String,
+			Scope:                   app.Scope.String,
+			Contacts:                app.Contacts,
+			RegistrationAccessToken: "", // RFC 7592: Not returned in GET responses for security
+			RegistrationClientURI:   app.RegistrationClientUri.String,
+		}
+
+		httpapi.Write(ctx, rw, http.StatusOK, response)
+	}
+}
+
+// UpdateClientConfiguration returns an http.HandlerFunc that handles PUT /oauth2/clients/{client_id}
+func UpdateClientConfiguration(db database.Store, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		aReq, commitAudit := audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{
+			Audit:   *auditor,
+			Log:     logger,
+			Request: r,
+			Action:  database.AuditActionWrite,
+		})
+		defer commitAudit()
+
+		// Extract client ID from URL path
+		clientIDStr := chi.URLParam(r, "client_id")
+		clientID, err := uuid.Parse(clientIDStr)
+		if err != nil {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest,
+				"invalid_client_metadata", "Invalid client ID format")
+			return
+		}
+
+		// Parse request
+		var req codersdk.OAuth2ClientRegistrationRequest
+		if !httpapi.Read(ctx, rw, r, &req) {
+			return
+		}
+
+		// Validate request
+		if err := req.Validate(); err != nil {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest,
+				"invalid_client_metadata", err.Error())
+			return
+		}
+
+		// Apply defaults
+		req = req.ApplyDefaults()
+
+		// Get existing app to verify it exists and is dynamically registered
+		//nolint:gocritic // RFC 7592 endpoints need system access to retrieve dynamically registered clients
+		existingApp, err := db.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID)
+		if err == nil {
+			aReq.Old = existingApp
+		}
+		if err != nil {
+			if xerrors.Is(err, sql.ErrNoRows) {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
+					"invalid_token", "Client not found")
+			} else {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+					"server_error", "Failed to retrieve client")
+			}
+			return
+		}
+
+		// Check if client was dynamically registered
+		if !existingApp.DynamicallyRegistered.Bool {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusForbidden,
+				"invalid_token", "Client was not dynamically registered")
+			return
+		}
+
+		// Update app in database
+		now := dbtime.Now()
+		//nolint:gocritic // RFC 7592 endpoints need system access to update dynamically registered clients
+		updatedApp, err := db.UpdateOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), database.UpdateOAuth2ProviderAppByClientIDParams{
+			ID:                      clientID,
+			UpdatedAt:               now,
+			Name:                    req.GenerateClientName(),
+			Icon:                    req.LogoURI,
+			CallbackURL:             req.RedirectURIs[0], // Primary redirect URI
+			RedirectUris:            req.RedirectURIs,
+			ClientType:              sql.NullString{String: req.DetermineClientType(), Valid: true},
+			ClientSecretExpiresAt:   sql.NullTime{}, // No expiration for now
+			GrantTypes:              req.GrantTypes,
+			ResponseTypes:           req.ResponseTypes,
+			TokenEndpointAuthMethod: sql.NullString{String: req.TokenEndpointAuthMethod, Valid: true},
+			Scope:                   sql.NullString{String: req.Scope, Valid: true},
+			Contacts:                req.Contacts,
+			ClientUri:               sql.NullString{String: req.ClientURI, Valid: req.ClientURI != ""},
+			LogoUri:                 sql.NullString{String: req.LogoURI, Valid: req.LogoURI != ""},
+			TosUri:                  sql.NullString{String: req.TOSURI, Valid: req.TOSURI != ""},
+			PolicyUri:               sql.NullString{String: req.PolicyURI, Valid: req.PolicyURI != ""},
+			JwksUri:                 sql.NullString{String: req.JWKSURI, Valid: req.JWKSURI != ""},
+			Jwks:                    pqtype.NullRawMessage{RawMessage: req.JWKS, Valid: len(req.JWKS) > 0},
+			SoftwareID:              sql.NullString{String: req.SoftwareID, Valid: req.SoftwareID != ""},
+			SoftwareVersion:         sql.NullString{String: req.SoftwareVersion, Valid: req.SoftwareVersion != ""},
+		})
+		if err != nil {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+				"server_error", "Failed to update client")
+			return
+		}
+
+		// Set audit log data
+		aReq.New = updatedApp
+
+		// Return updated client configuration
+		response := codersdk.OAuth2ClientConfiguration{
+			ClientID:                updatedApp.ID.String(),
+			ClientIDIssuedAt:        updatedApp.ClientIDIssuedAt.Time.Unix(),
+			ClientSecretExpiresAt:   0, // No expiration for now
+			RedirectURIs:            updatedApp.RedirectUris,
+			ClientName:              updatedApp.Name,
+			ClientURI:               updatedApp.ClientUri.String,
+			LogoURI:                 updatedApp.LogoUri.String,
+			TOSURI:                  updatedApp.TosUri.String,
+			PolicyURI:               updatedApp.PolicyUri.String,
+			JWKSURI:                 updatedApp.JwksUri.String,
+			JWKS:                    updatedApp.Jwks.RawMessage,
+			SoftwareID:              updatedApp.SoftwareID.String,
+			SoftwareVersion:         updatedApp.SoftwareVersion.String,
+			GrantTypes:              updatedApp.GrantTypes,
+			ResponseTypes:           updatedApp.ResponseTypes,
+			TokenEndpointAuthMethod: updatedApp.TokenEndpointAuthMethod.String,
+			Scope:                   updatedApp.Scope.String,
+			Contacts:                updatedApp.Contacts,
+			RegistrationAccessToken: updatedApp.RegistrationAccessToken.String,
+			RegistrationClientURI:   updatedApp.RegistrationClientUri.String,
+		}
+
+		httpapi.Write(ctx, rw, http.StatusOK, response)
+	}
+}
+
+// DeleteClientConfiguration returns an http.HandlerFunc that handles DELETE /oauth2/clients/{client_id}
+func DeleteClientConfiguration(db database.Store, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		aReq, commitAudit := audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{
+			Audit:   *auditor,
+			Log:     logger,
+			Request: r,
+			Action:  database.AuditActionDelete,
+		})
+		defer commitAudit()
+
+		// Extract client ID from URL path
+		clientIDStr := chi.URLParam(r, "client_id")
+		clientID, err := uuid.Parse(clientIDStr)
+		if err != nil {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest,
+				"invalid_client_metadata", "Invalid client ID format")
+			return
+		}
+
+		// Get existing app to verify it exists and is dynamically registered
+		//nolint:gocritic // RFC 7592 endpoints need system access to retrieve dynamically registered clients
+		existingApp, err := db.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID)
+		if err == nil {
+			aReq.Old = existingApp
+		}
+		if err != nil {
+			if xerrors.Is(err, sql.ErrNoRows) {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
+					"invalid_token", "Client not found")
+			} else {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+					"server_error", "Failed to retrieve client")
+			}
+			return
+		}
+
+		// Check if client was dynamically registered
+		if !existingApp.DynamicallyRegistered.Bool {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusForbidden,
+				"invalid_token", "Client was not dynamically registered")
+			return
+		}
+
+		// Delete the client and all associated data (tokens, secrets, etc.)
+		//nolint:gocritic // RFC 7592 endpoints need system access to delete dynamically registered clients
+		err = db.DeleteOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID)
+		if err != nil {
+			writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+				"server_error", "Failed to delete client")
+			return
+		}
+
+		// Note: audit data already set above with aReq.Old = existingApp
+
+		// Return 204 No Content as per RFC 7592
+		rw.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// RequireRegistrationAccessToken returns middleware that validates the registration access token for RFC 7592 endpoints
+func RequireRegistrationAccessToken(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			ctx := r.Context()
+
+			// Extract client ID from URL path
+			clientIDStr := chi.URLParam(r, "client_id")
+			clientID, err := uuid.Parse(clientIDStr)
+			if err != nil {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest,
+					"invalid_client_id", "Invalid client ID format")
+				return
+			}
+
+			// Extract registration access token from Authorization header
+			authHeader := r.Header.Get("Authorization")
+			if authHeader == "" {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
+					"invalid_token", "Missing Authorization header")
+				return
+			}
+
+			if !strings.HasPrefix(authHeader, "Bearer ") {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
+					"invalid_token", "Authorization header must use Bearer scheme")
+				return
+			}
+
+			token := strings.TrimPrefix(authHeader, "Bearer ")
+			if token == "" {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
+					"invalid_token", "Missing registration access token")
+				return
+			}
+
+			// Get the client and verify the registration access token
+			//nolint:gocritic // RFC 7592 endpoints need system access to validate dynamically registered clients
+			app, err := db.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID)
+			if err != nil {
+				if xerrors.Is(err, sql.ErrNoRows) {
+					// Return 401 for authentication-related issues, not 404
+					writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
+						"invalid_token", "Client not found")
+				} else {
+					writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+						"server_error", "Failed to retrieve client")
+				}
+				return
+			}
+
+			// Check if client was dynamically registered
+			if !app.DynamicallyRegistered.Bool {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusForbidden,
+					"invalid_token", "Client was not dynamically registered")
+				return
+			}
+
+			// Verify the registration access token
+			if !app.RegistrationAccessToken.Valid {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+					"server_error", "Client has no registration access token")
+				return
+			}
+
+			// Compare the provided token with the stored hash
+			valid, err := userpassword.Compare(app.RegistrationAccessToken.String, token)
+			if err != nil {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
+					"server_error", "Failed to verify registration access token")
+				return
+			}
+			if !valid {
+				writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
+					"invalid_token", "Invalid registration access token")
+				return
+			}
+
+			// Token is valid, continue to the next handler
+			next.ServeHTTP(rw, r)
+		})
+	}
+}
+
+// Helper functions for RFC 7591 Dynamic Client Registration
+
+// generateClientCredentials generates a client secret for OAuth2 apps
+func generateClientCredentials() (plaintext, hashed string, err error) {
+	// Use the same pattern as existing OAuth2 app secrets
+	secret, err := GenerateSecret()
+	if err != nil {
+		return "", "", xerrors.Errorf("generate secret: %w", err)
+	}
+
+	return secret.Formatted, secret.Hashed, nil
+}
+
+// generateRegistrationAccessToken generates a registration access token for RFC 7592
+func generateRegistrationAccessToken() (plaintext, hashed string, err error) {
+	token, err := cryptorand.String(secretLength)
+	if err != nil {
+		return "", "", xerrors.Errorf("generate registration token: %w", err)
+	}
+
+	// Hash the token for storage
+	hashedToken, err := userpassword.Hash(token)
+	if err != nil {
+		return "", "", xerrors.Errorf("hash registration token: %w", err)
+	}
+
+	return token, hashedToken, nil
+}
+
+// writeOAuth2RegistrationError writes RFC 7591 compliant error responses
+func writeOAuth2RegistrationError(_ context.Context, rw http.ResponseWriter, status int, errorCode, description string) {
+	// RFC 7591 error response format
+	errorResponse := map[string]string{
+		"error": errorCode,
+	}
+	if description != "" {
+		errorResponse["error_description"] = description
+	}
+
+	rw.Header().Set("Content-Type", "application/json")
+	rw.WriteHeader(status)
+	_ = json.NewEncoder(rw).Encode(errorResponse)
+}
+
+// parsedSecret represents the components of a formatted OAuth2 secret
+type parsedSecret struct {
+	prefix string
+	secret string
+}
+
+// parseFormattedSecret parses a formatted secret like "coder_prefix_secret"
+func parseFormattedSecret(secret string) (parsedSecret, error) {
+	parts := strings.Split(secret, "_")
+	if len(parts) != 3 {
+		return parsedSecret{}, xerrors.Errorf("incorrect number of parts: %d", len(parts))
+	}
+	if parts[0] != "coder" {
+		return parsedSecret{}, xerrors.Errorf("incorrect scheme: %s", parts[0])
+	}
+	return parsedSecret{
+		prefix: parts[1],
+		secret: parts[2],
+	}, nil
+}
+
+// createDisplaySecret creates a display version of the secret showing only the last few characters
+func createDisplaySecret(secret string) string {
+	if len(secret) <= displaySecretLength {
+		return secret
+	}
+
+	visiblePart := secret[len(secret)-displaySecretLength:]
+	hiddenLength := len(secret) - displaySecretLength
+	return strings.Repeat("*", hiddenLength) + visiblePart
+}
diff --git a/coderd/identityprovider/revoke.go b/coderd/oauth2provider/revoke.go
similarity index 97%
rename from coderd/identityprovider/revoke.go
rename to coderd/oauth2provider/revoke.go
index 78acb9ea0de22..243ce750288bb 100644
--- a/coderd/identityprovider/revoke.go
+++ b/coderd/oauth2provider/revoke.go
@@ -1,4 +1,4 @@
-package identityprovider
+package oauth2provider
 
 import (
 	"database/sql"
diff --git a/coderd/identityprovider/secrets.go b/coderd/oauth2provider/secrets.go
similarity index 57%
rename from coderd/identityprovider/secrets.go
rename to coderd/oauth2provider/secrets.go
index 72524b3d2a077..a360c0b325c89 100644
--- a/coderd/identityprovider/secrets.go
+++ b/coderd/oauth2provider/secrets.go
@@ -1,16 +1,13 @@
-package identityprovider
+package oauth2provider
 
 import (
 	"fmt"
-	"strings"
-
-	"golang.org/x/xerrors"
 
 	"github.com/coder/coder/v2/coderd/userpassword"
 	"github.com/coder/coder/v2/cryptorand"
 )
 
-type OAuth2ProviderAppSecret struct {
+type AppSecret struct {
 	// Formatted contains the secret. This value is owned by the client, not the
 	// server.  It is formatted to include the prefix.
 	Formatted string
@@ -26,11 +23,11 @@ type OAuth2ProviderAppSecret struct {
 
 // GenerateSecret generates a secret to be used as a client secret, refresh
 // token, or authorization code.
-func GenerateSecret() (OAuth2ProviderAppSecret, error) {
+func GenerateSecret() (AppSecret, error) {
 	// 40 characters matches the length of GitHub's client secrets.
 	secret, err := cryptorand.String(40)
 	if err != nil {
-		return OAuth2ProviderAppSecret{}, err
+		return AppSecret{}, err
 	}
 
 	// This ID is prefixed to the secret so it can be used to look up the secret
@@ -38,40 +35,17 @@ func GenerateSecret() (OAuth2ProviderAppSecret, error) {
 	// will not have the salt.
 	prefix, err := cryptorand.String(10)
 	if err != nil {
-		return OAuth2ProviderAppSecret{}, err
+		return AppSecret{}, err
 	}
 
 	hashed, err := userpassword.Hash(secret)
 	if err != nil {
-		return OAuth2ProviderAppSecret{}, err
+		return AppSecret{}, err
 	}
 
-	return OAuth2ProviderAppSecret{
+	return AppSecret{
 		Formatted: fmt.Sprintf("coder_%s_%s", prefix, secret),
 		Prefix:    prefix,
 		Hashed:    hashed,
 	}, nil
 }
-
-type parsedSecret struct {
-	prefix string
-	secret string
-}
-
-// parseSecret extracts the ID and original secret from a secret.
-func parseSecret(secret string) (parsedSecret, error) {
-	parts := strings.Split(secret, "_")
-	if len(parts) != 3 {
-		return parsedSecret{}, xerrors.Errorf("incorrect number of parts: %d", len(parts))
-	}
-	if parts[0] != "coder" {
-		return parsedSecret{}, xerrors.Errorf("incorrect scheme: %s", parts[0])
-	}
-	if len(parts[1]) == 0 {
-		return parsedSecret{}, xerrors.Errorf("prefix is invalid")
-	}
-	if len(parts[2]) == 0 {
-		return parsedSecret{}, xerrors.Errorf("invalid")
-	}
-	return parsedSecret{parts[1], parts[2]}, nil
-}
diff --git a/coderd/identityprovider/tokens.go b/coderd/oauth2provider/tokens.go
similarity index 98%
rename from coderd/identityprovider/tokens.go
rename to coderd/oauth2provider/tokens.go
index 4cacf8f06a637..afbc27dd8b5a8 100644
--- a/coderd/identityprovider/tokens.go
+++ b/coderd/oauth2provider/tokens.go
@@ -1,4 +1,4 @@
-package identityprovider
+package oauth2provider
 
 import (
 	"context"
@@ -183,7 +183,7 @@ func Tokens(db database.Store, lifetimes codersdk.SessionLifetime) http.HandlerF
 
 func authorizationCodeGrant(ctx context.Context, db database.Store, app database.OAuth2ProviderApp, lifetimes codersdk.SessionLifetime, params tokenParams) (oauth2.Token, error) {
 	// Validate the client secret.
-	secret, err := parseSecret(params.clientSecret)
+	secret, err := parseFormattedSecret(params.clientSecret)
 	if err != nil {
 		return oauth2.Token{}, errBadSecret
 	}
@@ -204,7 +204,7 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database
 	}
 
 	// Validate the authorization code.
-	code, err := parseSecret(params.code)
+	code, err := parseFormattedSecret(params.code)
 	if err != nil {
 		return oauth2.Token{}, errBadCode
 	}
@@ -335,7 +335,7 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database
 
 func refreshTokenGrant(ctx context.Context, db database.Store, app database.OAuth2ProviderApp, lifetimes codersdk.SessionLifetime, params tokenParams) (oauth2.Token, error) {
 	// Validate the token.
-	token, err := parseSecret(params.refreshToken)
+	token, err := parseFormattedSecret(params.refreshToken)
 	if err != nil {
 		return oauth2.Token{}, errBadToken
 	}
diff --git a/coderd/oauth2provider/validation_test.go b/coderd/oauth2provider/validation_test.go
new file mode 100644
index 0000000000000..c13c2756a5222
--- /dev/null
+++ b/coderd/oauth2provider/validation_test.go
@@ -0,0 +1,782 @@
+package oauth2provider_test
+
+import (
+	"fmt"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
+)
+
+// TestOAuth2ClientMetadataValidation tests enhanced metadata validation per RFC 7591
+func TestOAuth2ClientMetadataValidation(t *testing.T) {
+	t.Parallel()
+
+	t.Run("RedirectURIValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name          string
+			redirectURIs  []string
+			expectError   bool
+			errorContains string
+		}{
+			{
+				name:         "ValidHTTPS",
+				redirectURIs: []string{"https://example.com/callback"},
+				expectError:  false,
+			},
+			{
+				name:         "ValidLocalhost",
+				redirectURIs: []string{"http://localhost:8080/callback"},
+				expectError:  false,
+			},
+			{
+				name:         "ValidLocalhostIP",
+				redirectURIs: []string{"http://127.0.0.1:8080/callback"},
+				expectError:  false,
+			},
+			{
+				name:         "ValidCustomScheme",
+				redirectURIs: []string{"com.example.myapp://auth/callback"},
+				expectError:  false,
+			},
+			{
+				name:          "InvalidHTTPNonLocalhost",
+				redirectURIs:  []string{"http://example.com/callback"},
+				expectError:   true,
+				errorContains: "redirect_uri",
+			},
+			{
+				name:          "InvalidWithFragment",
+				redirectURIs:  []string{"https://example.com/callback#fragment"},
+				expectError:   true,
+				errorContains: "fragment",
+			},
+			{
+				name:          "InvalidJavaScriptScheme",
+				redirectURIs:  []string{"javascript:alert('xss')"},
+				expectError:   true,
+				errorContains: "dangerous scheme",
+			},
+			{
+				name:          "InvalidDataScheme",
+				redirectURIs:  []string{"data:text/html,<script>alert('xss')</script>"},
+				expectError:   true,
+				errorContains: "dangerous scheme",
+			},
+			{
+				name:          "InvalidFileScheme",
+				redirectURIs:  []string{"file:///etc/passwd"},
+				expectError:   true,
+				errorContains: "dangerous scheme",
+			},
+			{
+				name:          "EmptyString",
+				redirectURIs:  []string{""},
+				expectError:   true,
+				errorContains: "redirect_uri",
+			},
+			{
+				name:          "RelativeURL",
+				redirectURIs:  []string{"/callback"},
+				expectError:   true,
+				errorContains: "redirect_uri",
+			},
+			{
+				name:         "MultipleValid",
+				redirectURIs: []string{"https://example.com/callback", "com.example.app://auth"},
+				expectError:  false,
+			},
+			{
+				name:          "MixedValidInvalid",
+				redirectURIs:  []string{"https://example.com/callback", "http://example.com/callback"},
+				expectError:   true,
+				errorContains: "redirect_uri",
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs: test.redirectURIs,
+					ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+					if test.errorContains != "" {
+						require.Contains(t, strings.ToLower(err.Error()), strings.ToLower(test.errorContains))
+					}
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("ClientURIValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name        string
+			clientURI   string
+			expectError bool
+		}{
+			{
+				name:        "ValidHTTPS",
+				clientURI:   "https://example.com",
+				expectError: false,
+			},
+			{
+				name:        "ValidHTTPLocalhost",
+				clientURI:   "http://localhost:8080",
+				expectError: false,
+			},
+			{
+				name:        "ValidWithPath",
+				clientURI:   "https://example.com/app",
+				expectError: false,
+			},
+			{
+				name:        "ValidWithQuery",
+				clientURI:   "https://example.com/app?param=value",
+				expectError: false,
+			},
+			{
+				name:        "InvalidNotURL",
+				clientURI:   "not-a-url",
+				expectError: true,
+			},
+			{
+				name:        "ValidWithFragment",
+				clientURI:   "https://example.com#fragment",
+				expectError: false, // Fragments are allowed in client_uri, unlike redirect_uri
+			},
+			{
+				name:        "InvalidJavaScript",
+				clientURI:   "javascript:alert('xss')",
+				expectError: true, // Only http/https allowed for client_uri
+			},
+			{
+				name:        "InvalidFTP",
+				clientURI:   "ftp://example.com",
+				expectError: true, // Only http/https allowed for client_uri
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs: []string{"https://example.com/callback"},
+					ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+					ClientURI:    test.clientURI,
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("LogoURIValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name        string
+			logoURI     string
+			expectError bool
+		}{
+			{
+				name:        "ValidHTTPS",
+				logoURI:     "https://example.com/logo.png",
+				expectError: false,
+			},
+			{
+				name:        "ValidHTTPLocalhost",
+				logoURI:     "http://localhost:8080/logo.png",
+				expectError: false,
+			},
+			{
+				name:        "ValidWithQuery",
+				logoURI:     "https://example.com/logo.png?size=large",
+				expectError: false,
+			},
+			{
+				name:        "InvalidNotURL",
+				logoURI:     "not-a-url",
+				expectError: true,
+			},
+			{
+				name:        "ValidWithFragment",
+				logoURI:     "https://example.com/logo.png#fragment",
+				expectError: false, // Fragments are allowed in logo_uri
+			},
+			{
+				name:        "InvalidJavaScript",
+				logoURI:     "javascript:alert('xss')",
+				expectError: true, // Only http/https allowed for logo_uri
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs: []string{"https://example.com/callback"},
+					ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+					LogoURI:      test.logoURI,
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("GrantTypeValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name        string
+			grantTypes  []string
+			expectError bool
+		}{
+			{
+				name:        "DefaultEmpty",
+				grantTypes:  []string{},
+				expectError: false,
+			},
+			{
+				name:        "ValidAuthorizationCode",
+				grantTypes:  []string{"authorization_code"},
+				expectError: false,
+			},
+			{
+				name:        "InvalidRefreshTokenAlone",
+				grantTypes:  []string{"refresh_token"},
+				expectError: true, // refresh_token requires authorization_code to be present
+			},
+			{
+				name:        "ValidMultiple",
+				grantTypes:  []string{"authorization_code", "refresh_token"},
+				expectError: false,
+			},
+			{
+				name:        "InvalidUnsupported",
+				grantTypes:  []string{"client_credentials"},
+				expectError: true,
+			},
+			{
+				name:        "InvalidPassword",
+				grantTypes:  []string{"password"},
+				expectError: true,
+			},
+			{
+				name:        "InvalidImplicit",
+				grantTypes:  []string{"implicit"},
+				expectError: true,
+			},
+			{
+				name:        "MixedValidInvalid",
+				grantTypes:  []string{"authorization_code", "client_credentials"},
+				expectError: true,
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs: []string{"https://example.com/callback"},
+					ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+					GrantTypes:   test.grantTypes,
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("ResponseTypeValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name          string
+			responseTypes []string
+			expectError   bool
+		}{
+			{
+				name:          "DefaultEmpty",
+				responseTypes: []string{},
+				expectError:   false,
+			},
+			{
+				name:          "ValidCode",
+				responseTypes: []string{"code"},
+				expectError:   false,
+			},
+			{
+				name:          "InvalidToken",
+				responseTypes: []string{"token"},
+				expectError:   true,
+			},
+			{
+				name:          "InvalidImplicit",
+				responseTypes: []string{"id_token"},
+				expectError:   true,
+			},
+			{
+				name:          "InvalidMultiple",
+				responseTypes: []string{"code", "token"},
+				expectError:   true,
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs:  []string{"https://example.com/callback"},
+					ClientName:    fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+					ResponseTypes: test.responseTypes,
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("TokenEndpointAuthMethodValidation", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		tests := []struct {
+			name        string
+			authMethod  string
+			expectError bool
+		}{
+			{
+				name:        "DefaultEmpty",
+				authMethod:  "",
+				expectError: false,
+			},
+			{
+				name:        "ValidClientSecretBasic",
+				authMethod:  "client_secret_basic",
+				expectError: false,
+			},
+			{
+				name:        "ValidClientSecretPost",
+				authMethod:  "client_secret_post",
+				expectError: false,
+			},
+			{
+				name:        "ValidNone",
+				authMethod:  "none",
+				expectError: false, // "none" is valid for public clients per RFC 7591
+			},
+			{
+				name:        "InvalidPrivateKeyJWT",
+				authMethod:  "private_key_jwt",
+				expectError: true,
+			},
+			{
+				name:        "InvalidClientSecretJWT",
+				authMethod:  "client_secret_jwt",
+				expectError: true,
+			},
+			{
+				name:        "InvalidCustom",
+				authMethod:  "custom_method",
+				expectError: true,
+			},
+		}
+
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				req := codersdk.OAuth2ClientRegistrationRequest{
+					RedirectURIs:            []string{"https://example.com/callback"},
+					ClientName:              fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+					TokenEndpointAuthMethod: test.authMethod,
+				}
+
+				_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+				if test.expectError {
+					require.Error(t, err)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+}
+
+// TestOAuth2ClientNameValidation tests client name validation requirements
+func TestOAuth2ClientNameValidation(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name        string
+		clientName  string
+		expectError bool
+	}{
+		{
+			name:        "ValidBasic",
+			clientName:  "My App",
+			expectError: false,
+		},
+		{
+			name:        "ValidWithNumbers",
+			clientName:  "My App 2.0",
+			expectError: false,
+		},
+		{
+			name:        "ValidWithSpecialChars",
+			clientName:  "My-App_v1.0",
+			expectError: false,
+		},
+		{
+			name:        "ValidUnicode",
+			clientName:  "My App 🚀",
+			expectError: false,
+		},
+		{
+			name:        "ValidLong",
+			clientName:  strings.Repeat("A", 100),
+			expectError: false,
+		},
+		{
+			name:        "ValidEmpty",
+			clientName:  "",
+			expectError: false, // Empty names are allowed, defaults are applied
+		},
+		{
+			name:        "ValidWhitespaceOnly",
+			clientName:  "   ",
+			expectError: false, // Whitespace-only names are allowed
+		},
+		{
+			name:        "ValidTooLong",
+			clientName:  strings.Repeat("A", 1000),
+			expectError: false, // Very long names are allowed
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			_ = coderdtest.CreateFirstUser(t, client)
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			req := codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"https://example.com/callback"},
+				ClientName:   test.clientName,
+			}
+
+			_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+			if test.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+// TestOAuth2ClientScopeValidation tests scope parameter validation
+func TestOAuth2ClientScopeValidation(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name        string
+		scope       string
+		expectError bool
+	}{
+		{
+			name:        "DefaultEmpty",
+			scope:       "",
+			expectError: false,
+		},
+		{
+			name:        "ValidRead",
+			scope:       "read",
+			expectError: false,
+		},
+		{
+			name:        "ValidWrite",
+			scope:       "write",
+			expectError: false,
+		},
+		{
+			name:        "ValidMultiple",
+			scope:       "read write",
+			expectError: false,
+		},
+		{
+			name:        "ValidOpenID",
+			scope:       "openid",
+			expectError: false,
+		},
+		{
+			name:        "ValidProfile",
+			scope:       "profile",
+			expectError: false,
+		},
+		{
+			name:        "ValidEmail",
+			scope:       "email",
+			expectError: false,
+		},
+		{
+			name:        "ValidCombined",
+			scope:       "openid profile email read write",
+			expectError: false,
+		},
+		{
+			name:        "InvalidAdmin",
+			scope:       "admin",
+			expectError: false, // Admin scope should be allowed but validated during authorization
+		},
+		{
+			name:        "ValidCustom",
+			scope:       "custom:scope",
+			expectError: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			_ = coderdtest.CreateFirstUser(t, client)
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			req := codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"https://example.com/callback"},
+				ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+				Scope:        test.scope,
+			}
+
+			_, err := client.PostOAuth2ClientRegistration(ctx, req)
+
+			if test.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+// TestOAuth2ClientMetadataDefaults tests that default values are properly applied
+func TestOAuth2ClientMetadataDefaults(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, nil)
+	_ = coderdtest.CreateFirstUser(t, client)
+
+	ctx := testutil.Context(t, testutil.WaitLong)
+
+	// Register a minimal client to test defaults
+	req := codersdk.OAuth2ClientRegistrationRequest{
+		RedirectURIs: []string{"https://example.com/callback"},
+		ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+	}
+
+	resp, err := client.PostOAuth2ClientRegistration(ctx, req)
+	require.NoError(t, err)
+
+	// Get the configuration to check defaults
+	config, err := client.GetOAuth2ClientConfiguration(ctx, resp.ClientID, resp.RegistrationAccessToken)
+	require.NoError(t, err)
+
+	// Should default to authorization_code
+	require.Contains(t, config.GrantTypes, "authorization_code")
+
+	// Should default to code
+	require.Contains(t, config.ResponseTypes, "code")
+
+	// Should default to client_secret_basic or client_secret_post
+	require.True(t, config.TokenEndpointAuthMethod == "client_secret_basic" ||
+		config.TokenEndpointAuthMethod == "client_secret_post" ||
+		config.TokenEndpointAuthMethod == "")
+
+	// Client secret should be generated
+	require.NotEmpty(t, resp.ClientSecret)
+	require.Greater(t, len(resp.ClientSecret), 20)
+
+	// Registration access token should be generated
+	require.NotEmpty(t, resp.RegistrationAccessToken)
+	require.Greater(t, len(resp.RegistrationAccessToken), 20)
+}
+
+// TestOAuth2ClientMetadataEdgeCases tests edge cases and boundary conditions
+func TestOAuth2ClientMetadataEdgeCases(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ExtremelyLongRedirectURI", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Create a very long but valid HTTPS URI
+		longPath := strings.Repeat("a", 2000)
+		longURI := "https://example.com/" + longPath
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{longURI},
+			ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		// This might be accepted or rejected depending on URI length limits
+		// The test verifies the behavior is consistent
+		if err != nil {
+			require.Contains(t, strings.ToLower(err.Error()), "uri")
+		}
+	})
+
+	t.Run("ManyRedirectURIs", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Test with many redirect URIs
+		redirectURIs := make([]string, 20)
+		for i := 0; i < 20; i++ {
+			redirectURIs[i] = fmt.Sprintf("https://example%d.com/callback", i)
+		}
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: redirectURIs,
+			ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		// Should handle multiple redirect URIs gracefully
+		require.NoError(t, err)
+	})
+
+	t.Run("URIWithUnusualPort", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com:8443/callback"},
+			ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+	})
+
+	t.Run("URIWithComplexPath", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{"https://example.com/path/to/callback?param=value&other=123"},
+			ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+	})
+
+	t.Run("URIWithEncodedCharacters", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, nil)
+		_ = coderdtest.CreateFirstUser(t, client)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// Test with URL-encoded characters
+		encodedURI := "https://example.com/callback?param=" + url.QueryEscape("value with spaces")
+
+		req := codersdk.OAuth2ClientRegistrationRequest{
+			RedirectURIs: []string{encodedURI},
+			ClientName:   fmt.Sprintf("test-client-%d", time.Now().UnixNano()),
+		}
+
+		_, err := client.PostOAuth2ClientRegistration(ctx, req)
+		require.NoError(t, err)
+	})
+}
diff --git a/coderd/parameters_test.go b/coderd/parameters_test.go
index 3a5cae7adbe5b..855d95eb1de59 100644
--- a/coderd/parameters_test.go
+++ b/coderd/parameters_test.go
@@ -70,6 +70,8 @@ func TestDynamicParametersOwnerSSHPublicKey(t *testing.T) {
 	require.Equal(t, sshKey.PublicKey, preview.Parameters[0].Value.Value)
 }
 
+// TestDynamicParametersWithTerraformValues is for testing the websocket flow of
+// dynamic parameters. No workspaces are created.
 func TestDynamicParametersWithTerraformValues(t *testing.T) {
 	t.Parallel()
 
diff --git a/coderd/templateversions.go b/coderd/templateversions.go
index d79f86f1f6626..fa5a7ed1fe757 100644
--- a/coderd/templateversions.go
+++ b/coderd/templateversions.go
@@ -1,6 +1,7 @@
 package coderd
 
 import (
+	"bytes"
 	"context"
 	"crypto/sha256"
 	"database/sql"
@@ -8,6 +9,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io/fs"
+	stdslog "log/slog"
 	"net/http"
 	"os"
 
@@ -18,6 +21,9 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
+	archivefs "github.com/coder/coder/v2/archive/fs"
+	"github.com/coder/coder/v2/coderd/dynamicparameters"
+	"github.com/coder/preview"
 
 	"github.com/coder/coder/v2/coderd/audit"
 	"github.com/coder/coder/v2/coderd/database"
@@ -1464,8 +1470,9 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht
 		return
 	}
 
+	var dynamicTemplate bool
 	if req.TemplateID != uuid.Nil {
-		_, err := api.Database.GetTemplateByID(ctx, req.TemplateID)
+		tpl, err := api.Database.GetTemplateByID(ctx, req.TemplateID)
 		if httpapi.Is404Error(err) {
 			httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{
 				Message: "Template does not exist.",
@@ -1479,6 +1486,7 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht
 			})
 			return
 		}
+		dynamicTemplate = !tpl.UseClassicParameterFlow
 	}
 
 	if req.ExampleID != "" && req.FileID != uuid.Nil {
@@ -1574,45 +1582,18 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht
 		}
 	}
 
-	// Try to parse template tags from the given file.
-	tempDir, err := os.MkdirTemp(api.Options.CacheDir, "tfparse-*")
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error checking workspace tags",
-			Detail:  "create tempdir: " + err.Error(),
-		})
-		return
-	}
-	defer func() {
-		if err := os.RemoveAll(tempDir); err != nil {
-			api.Logger.Error(ctx, "failed to remove temporary tfparse dir", slog.Error(err))
+	var parsedTags map[string]string
+	var ok bool
+	if dynamicTemplate {
+		parsedTags, ok = api.dynamicTemplateVersionTags(ctx, rw, organization.ID, apiKey.UserID, file)
+		if !ok {
+			return
+		}
+	} else {
+		parsedTags, ok = api.classicTemplateVersionTags(ctx, rw, file)
+		if !ok {
+			return
 		}
-	}()
-
-	if err := tfparse.WriteArchive(file.Data, file.Mimetype, tempDir); err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error checking workspace tags",
-			Detail:  "extract archive to tempdir: " + err.Error(),
-		})
-		return
-	}
-
-	parser, diags := tfparse.New(tempDir, tfparse.WithLogger(api.Logger.Named("tfparse")))
-	if diags.HasErrors() {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error checking workspace tags",
-			Detail:  "parse module: " + diags.Error(),
-		})
-		return
-	}
-
-	parsedTags, err := parser.WorkspaceTagDefaults(ctx)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error checking workspace tags",
-			Detail:  "evaluate default values of workspace tags: " + err.Error(),
-		})
-		return
 	}
 
 	// Ensure the "owner" tag is properly applied in addition to request tags and coder_workspace_tags.
@@ -1781,6 +1762,105 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht
 		warnings))
 }
 
+func (api *API) dynamicTemplateVersionTags(ctx context.Context, rw http.ResponseWriter, orgID uuid.UUID, owner uuid.UUID, file database.File) (map[string]string, bool) {
+	ownerData, err := dynamicparameters.WorkspaceOwner(ctx, api.Database, orgID, owner)
+	if err != nil {
+		if httpapi.Is404Error(err) {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Internal error checking workspace tags",
+				Detail:  fmt.Sprintf("Owner not found, uuid=%s", owner.String()),
+			})
+			return nil, false
+		}
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error checking workspace tags",
+			Detail:  "fetch owner data: " + err.Error(),
+		})
+		return nil, false
+	}
+
+	var files fs.FS
+	switch file.Mimetype {
+	case "application/x-tar":
+		files = archivefs.FromTarReader(bytes.NewBuffer(file.Data))
+	case "application/zip":
+		files, err = archivefs.FromZipReader(bytes.NewReader(file.Data), int64(len(file.Data)))
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error checking workspace tags",
+				Detail:  "extract zip archive: " + err.Error(),
+			})
+			return nil, false
+		}
+	default:
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "Unsupported file type for dynamic template version tags",
+			Detail:  fmt.Sprintf("Mimetype %q is not supported for dynamic template version tags", file.Mimetype),
+		})
+		return nil, false
+	}
+
+	output, diags := preview.Preview(ctx, preview.Input{
+		PlanJSON:        nil, // Template versions are before `terraform plan`
+		ParameterValues: nil, // No user-specified parameters
+		Owner:           *ownerData,
+		Logger:          stdslog.New(stdslog.DiscardHandler),
+	}, files)
+	tagErr := dynamicparameters.CheckTags(output, diags)
+	if tagErr != nil {
+		code, resp := tagErr.Response()
+		httpapi.Write(ctx, rw, code, resp)
+		return nil, false
+	}
+
+	return output.WorkspaceTags.Tags(), true
+}
+
+func (api *API) classicTemplateVersionTags(ctx context.Context, rw http.ResponseWriter, file database.File) (map[string]string, bool) {
+	// Try to parse template tags from the given file.
+	tempDir, err := os.MkdirTemp(api.Options.CacheDir, "tfparse-*")
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error checking workspace tags",
+			Detail:  "create tempdir: " + err.Error(),
+		})
+		return nil, false
+	}
+	defer func() {
+		if err := os.RemoveAll(tempDir); err != nil {
+			api.Logger.Error(ctx, "failed to remove temporary tfparse dir", slog.Error(err))
+		}
+	}()
+
+	if err := tfparse.WriteArchive(file.Data, file.Mimetype, tempDir); err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error checking workspace tags",
+			Detail:  "extract archive to tempdir: " + err.Error(),
+		})
+		return nil, false
+	}
+
+	parser, diags := tfparse.New(tempDir, tfparse.WithLogger(api.Logger.Named("tfparse")))
+	if diags.HasErrors() {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error checking workspace tags",
+			Detail:  "parse module: " + diags.Error(),
+		})
+		return nil, false
+	}
+
+	parsedTags, err := parser.WorkspaceTagDefaults(ctx)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error checking workspace tags",
+			Detail:  "evaluate default values of workspace tags: " + err.Error(),
+		})
+		return nil, false
+	}
+
+	return parsedTags, true
+}
+
 // templateVersionResources returns the workspace agent resources associated
 // with a template version. A template can specify more than one resource to be
 // provisioned, each resource can have an agent that dials back to coderd. The
diff --git a/coderd/wsbuilder/wsbuilder.go b/coderd/wsbuilder/wsbuilder.go
index ec0ef4df16b43..90ea02e966a09 100644
--- a/coderd/wsbuilder/wsbuilder.go
+++ b/coderd/wsbuilder/wsbuilder.go
@@ -83,6 +83,7 @@ type Builder struct {
 	parameterValues                      *[]string
 	templateVersionPresetParameterValues *[]database.TemplateVersionPresetParameter
 	parameterRender                      dynamicparameters.Renderer
+	workspaceTags                        *map[string]string
 
 	prebuiltWorkspaceBuildStage  sdkproto.PrebuiltWorkspaceBuildStage
 	verifyNoLegacyParametersOnce bool
@@ -939,6 +940,76 @@ func (b *Builder) getLastBuildJob() (*database.ProvisionerJob, error) {
 }
 
 func (b *Builder) getProvisionerTags() (map[string]string, error) {
+	if b.workspaceTags != nil {
+		return *b.workspaceTags, nil
+	}
+
+	var tags map[string]string
+	var err error
+
+	if b.usingDynamicParameters() {
+		tags, err = b.getDynamicProvisionerTags()
+	} else {
+		tags, err = b.getClassicProvisionerTags()
+	}
+	if err != nil {
+		return nil, xerrors.Errorf("get provisioner tags: %w", err)
+	}
+
+	b.workspaceTags = &tags
+	return *b.workspaceTags, nil
+}
+
+func (b *Builder) getDynamicProvisionerTags() (map[string]string, error) {
+	// Step 1: Mutate template manually set version tags
+	templateVersionJob, err := b.getTemplateVersionJob()
+	if err != nil {
+		return nil, BuildError{http.StatusInternalServerError, "failed to fetch template version job", err}
+	}
+	annotationTags := provisionersdk.MutateTags(b.workspace.OwnerID, templateVersionJob.Tags)
+
+	tags := map[string]string{}
+	for name, value := range annotationTags {
+		tags[name] = value
+	}
+
+	// Step 2: Fetch tags from the template
+	render, err := b.getDynamicParameterRenderer()
+	if err != nil {
+		return nil, BuildError{http.StatusInternalServerError, "failed to get dynamic parameter renderer", err}
+	}
+
+	names, values, err := b.getParameters()
+	if err != nil {
+		return nil, xerrors.Errorf("tags render: %w", err)
+	}
+
+	vals := make(map[string]string, len(names))
+	for i, name := range names {
+		if i >= len(values) {
+			return nil, BuildError{
+				http.StatusInternalServerError,
+				fmt.Sprintf("parameter names and values mismatch, %d names & %d values", len(names), len(values)),
+				xerrors.New("names and values mismatch"),
+			}
+		}
+		vals[name] = values[i]
+	}
+
+	output, diags := render.Render(b.ctx, b.workspace.OwnerID, vals)
+	tagErr := dynamicparameters.CheckTags(output, diags)
+	if tagErr != nil {
+		return nil, tagErr
+	}
+
+	for k, v := range output.WorkspaceTags.Tags() {
+		tags[k] = v
+	}
+
+	return tags, nil
+}
+
+func (b *Builder) getClassicProvisionerTags() (map[string]string, error) {
 	// Step 1: Mutate template version tags
 	templateVersionJob, err := b.getTemplateVersionJob()
 	if err != nil {
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
index 229e62eac87b3..b24e321b8e434 100644
--- a/codersdk/deployment.go
+++ b/codersdk/deployment.go
@@ -16,6 +16,8 @@ import (
 
 	"github.com/google/uuid"
 	"golang.org/x/mod/semver"
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
 	"golang.org/x/xerrors"
 
 	"github.com/coreos/go-oidc/v3/oidc"
@@ -3341,8 +3343,34 @@ const (
 	ExperimentNotifications      Experiment = "notifications"        // Sends notifications via SMTP and webhooks following certain events.
 	ExperimentWorkspaceUsage     Experiment = "workspace-usage"      // Enables the new workspace usage tracking.
 	ExperimentWebPush            Experiment = "web-push"             // Enables web push notifications through the browser.
+	ExperimentOAuth2             Experiment = "oauth2"               // Enables OAuth2 provider functionality.
+	ExperimentMCPServerHTTP      Experiment = "mcp-server-http"      // Enables the MCP HTTP server functionality.
 )
 
+func (e Experiment) DisplayName() string {
+	switch e {
+	case ExperimentExample:
+		return "Example Experiment"
+	case ExperimentAutoFillParameters:
+		return "Auto-fill Template Parameters"
+	case ExperimentNotifications:
+		return "SMTP and Webhook Notifications"
+	case ExperimentWorkspaceUsage:
+		return "Workspace Usage Tracking"
+	case ExperimentWebPush:
+		return "Browser Push Notifications"
+	case ExperimentOAuth2:
+		return "OAuth2 Provider Functionality"
+	case ExperimentMCPServerHTTP:
+		return "MCP HTTP Server Functionality"
+	default:
+		// Split on hyphen and convert to title case
+		// e.g. "web-push" -> "Web Push", "mcp-server-http" -> "Mcp Server Http"
+		caser := cases.Title(language.English)
+		return caser.String(strings.ReplaceAll(string(e), "-", " "))
+	}
+}
+
 // ExperimentsKnown should include all experiments defined above.
 var ExperimentsKnown = Experiments{
 	ExperimentExample,
@@ -3350,6 +3378,8 @@ var ExperimentsKnown = Experiments{
 	ExperimentNotifications,
 	ExperimentWorkspaceUsage,
 	ExperimentWebPush,
+	ExperimentOAuth2,
+	ExperimentMCPServerHTTP,
 }
 
 // ExperimentsSafe should include all experiments that are safe for
@@ -3367,14 +3397,9 @@ var ExperimentsSafe = Experiments{}
 // @typescript-ignore Experiments
 type Experiments []Experiment
 
-// Returns a list of experiments that are enabled for the deployment.
+// Enabled returns a list of experiments that are enabled for the deployment.
 func (e Experiments) Enabled(ex Experiment) bool {
-	for _, v := range e {
-		if v == ex {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(e, ex)
 }
 
 func (c *Client) Experiments(ctx context.Context) (Experiments, error) {
diff --git a/codersdk/oauth2.go b/codersdk/oauth2.go
index 4c4407cbeaca1..c2c59ed599190 100644
--- a/codersdk/oauth2.go
+++ b/codersdk/oauth2.go
@@ -2,9 +2,11 @@ package codersdk
 
 import (
 	"context"
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 
 	"github.com/google/uuid"
 )
@@ -252,3 +254,216 @@ type OAuth2ProtectedResourceMetadata struct {
 	ScopesSupported        []string `json:"scopes_supported,omitempty"`
 	BearerMethodsSupported []string `json:"bearer_methods_supported,omitempty"`
 }
+
+// OAuth2ClientRegistrationRequest represents RFC 7591 Dynamic Client Registration Request
+type OAuth2ClientRegistrationRequest struct {
+	RedirectURIs            []string        `json:"redirect_uris,omitempty"`
+	ClientName              string          `json:"client_name,omitempty"`
+	ClientURI               string          `json:"client_uri,omitempty"`
+	LogoURI                 string          `json:"logo_uri,omitempty"`
+	TOSURI                  string          `json:"tos_uri,omitempty"`
+	PolicyURI               string          `json:"policy_uri,omitempty"`
+	JWKSURI                 string          `json:"jwks_uri,omitempty"`
+	JWKS                    json.RawMessage `json:"jwks,omitempty" swaggertype:"object"`
+	SoftwareID              string          `json:"software_id,omitempty"`
+	SoftwareVersion         string          `json:"software_version,omitempty"`
+	SoftwareStatement       string          `json:"software_statement,omitempty"`
+	GrantTypes              []string        `json:"grant_types,omitempty"`
+	ResponseTypes           []string        `json:"response_types,omitempty"`
+	TokenEndpointAuthMethod string          `json:"token_endpoint_auth_method,omitempty"`
+	Scope                   string          `json:"scope,omitempty"`
+	Contacts                []string        `json:"contacts,omitempty"`
+}
+
+func (req OAuth2ClientRegistrationRequest) ApplyDefaults() OAuth2ClientRegistrationRequest {
+	// Apply grant type defaults
+	if len(req.GrantTypes) == 0 {
+		req.GrantTypes = []string{
+			string(OAuth2ProviderGrantTypeAuthorizationCode),
+			string(OAuth2ProviderGrantTypeRefreshToken),
+		}
+	}
+
+	// Apply response type defaults
+	if len(req.ResponseTypes) == 0 {
+		req.ResponseTypes = []string{
+			string(OAuth2ProviderResponseTypeCode),
+		}
+	}
+
+	// Apply token endpoint auth method default (RFC 7591 section 2)
+	if req.TokenEndpointAuthMethod == "" {
+		// Default according to RFC 7591: "client_secret_basic" for confidential clients
+		// For public clients, should be explicitly set to "none"
+		req.TokenEndpointAuthMethod = "client_secret_basic"
+	}
+
+	// Apply client name default if not provided
+	if req.ClientName == "" {
+		req.ClientName = "Dynamically Registered Client"
+	}
+
+	return req
+}
+
+// DetermineClientType determines if client is public or confidential
+func (*OAuth2ClientRegistrationRequest) DetermineClientType() string {
+	// For now, default to confidential
+	// In the future, we might detect based on:
+	// - token_endpoint_auth_method == "none" -> public
+	// - application_type == "native" -> might be public
+	// - Other heuristics
+	return "confidential"
+}
+
+// GenerateClientName generates a client name if not provided
+func (req *OAuth2ClientRegistrationRequest) GenerateClientName() string {
+	if req.ClientName != "" {
+		// Ensure client name fits database constraint (varchar(64))
+		if len(req.ClientName) > 64 {
+			// Preserve uniqueness by including a hash of the original name
+			hash := fmt.Sprintf("%x", sha256.Sum256([]byte(req.ClientName)))[:8]
+			maxPrefix := 64 - 1 - len(hash) // 1 for separator
+			return req.ClientName[:maxPrefix] + "-" + hash
+		}
+		return req.ClientName
+	}
+
+	// Try to derive from client_uri
+	if req.ClientURI != "" {
+		if uri, err := url.Parse(req.ClientURI); err == nil && uri.Host != "" {
+			name := fmt.Sprintf("Client (%s)", uri.Host)
+			if len(name) > 64 {
+				return name[:64]
+			}
+			return name
+		}
+	}
+
+	// Try to derive from first redirect URI
+	if len(req.RedirectURIs) > 0 {
+		if uri, err := url.Parse(req.RedirectURIs[0]); err == nil && uri.Host != "" {
+			name := fmt.Sprintf("Client (%s)", uri.Host)
+			if len(name) > 64 {
+				return name[:64]
+			}
+			return name
+		}
+	}
+
+	return "Dynamically Registered Client"
+}
+
+// OAuth2ClientRegistrationResponse represents RFC 7591 Dynamic Client Registration Response
+type OAuth2ClientRegistrationResponse struct {
+	ClientID                string          `json:"client_id"`
+	ClientSecret            string          `json:"client_secret,omitempty"`
+	ClientIDIssuedAt        int64           `json:"client_id_issued_at"`
+	ClientSecretExpiresAt   int64           `json:"client_secret_expires_at,omitempty"`
+	RedirectURIs            []string        `json:"redirect_uris,omitempty"`
+	ClientName              string          `json:"client_name,omitempty"`
+	ClientURI               string          `json:"client_uri,omitempty"`
+	LogoURI                 string          `json:"logo_uri,omitempty"`
+	TOSURI                  string          `json:"tos_uri,omitempty"`
+	PolicyURI               string          `json:"policy_uri,omitempty"`
+	JWKSURI                 string          `json:"jwks_uri,omitempty"`
+	JWKS                    json.RawMessage `json:"jwks,omitempty" swaggertype:"object"`
+	SoftwareID              string          `json:"software_id,omitempty"`
+	SoftwareVersion         string          `json:"software_version,omitempty"`
+	GrantTypes              []string        `json:"grant_types"`
+	ResponseTypes           []string        `json:"response_types"`
+	TokenEndpointAuthMethod string          `json:"token_endpoint_auth_method"`
+	Scope                   string          `json:"scope,omitempty"`
+	Contacts                []string        `json:"contacts,omitempty"`
+	RegistrationAccessToken string          `json:"registration_access_token"`
+	RegistrationClientURI   string          `json:"registration_client_uri"`
+}
+
+// PostOAuth2ClientRegistration dynamically registers a new OAuth2 client (RFC 7591)
+func (c *Client) PostOAuth2ClientRegistration(ctx context.Context, req OAuth2ClientRegistrationRequest) (OAuth2ClientRegistrationResponse, error) {
+	res, err := c.Request(ctx, http.MethodPost, "/oauth2/register", req)
+	if err != nil {
+		return OAuth2ClientRegistrationResponse{}, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusCreated {
+		return OAuth2ClientRegistrationResponse{}, ReadBodyAsError(res)
+	}
+	var resp OAuth2ClientRegistrationResponse
+	return resp, json.NewDecoder(res.Body).Decode(&resp)
+}
+
+// GetOAuth2ClientConfiguration retrieves client configuration (RFC 7592)
+func (c *Client) GetOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string) (OAuth2ClientConfiguration, error) {
+	res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/oauth2/clients/%s", clientID), nil,
+		func(r *http.Request) {
+			r.Header.Set("Authorization", "Bearer "+registrationAccessToken)
+		})
+	if err != nil {
+		return OAuth2ClientConfiguration{}, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return OAuth2ClientConfiguration{}, ReadBodyAsError(res)
+	}
+	var resp OAuth2ClientConfiguration
+	return resp, json.NewDecoder(res.Body).Decode(&resp)
+}
+
+// PutOAuth2ClientConfiguration updates client configuration (RFC 7592)
+func (c *Client) PutOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string, req OAuth2ClientRegistrationRequest) (OAuth2ClientConfiguration, error) {
+	res, err := c.Request(ctx, http.MethodPut, fmt.Sprintf("/oauth2/clients/%s", clientID), req,
+		func(r *http.Request) {
+			r.Header.Set("Authorization", "Bearer "+registrationAccessToken)
+		})
+	if err != nil {
+		return OAuth2ClientConfiguration{}, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return OAuth2ClientConfiguration{}, ReadBodyAsError(res)
+	}
+	var resp OAuth2ClientConfiguration
+	return resp, json.NewDecoder(res.Body).Decode(&resp)
+}
+
+// DeleteOAuth2ClientConfiguration deletes client registration (RFC 7592)
+func (c *Client) DeleteOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string) error {
+	res, err := c.Request(ctx, http.MethodDelete, fmt.Sprintf("/oauth2/clients/%s", clientID), nil,
+		func(r *http.Request) {
+			r.Header.Set("Authorization", "Bearer "+registrationAccessToken)
+		})
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusNoContent {
+		return ReadBodyAsError(res)
+	}
+	return nil
+}
+
+// OAuth2ClientConfiguration represents RFC 7592 Client Configuration (for GET/PUT operations)
+// Same as OAuth2ClientRegistrationResponse but without client_secret in GET responses
+type OAuth2ClientConfiguration struct {
+	ClientID                string          `json:"client_id"`
+	ClientIDIssuedAt        int64           `json:"client_id_issued_at"`
+	ClientSecretExpiresAt   int64           `json:"client_secret_expires_at,omitempty"`
+	RedirectURIs            []string        `json:"redirect_uris,omitempty"`
+	ClientName              string          `json:"client_name,omitempty"`
+	ClientURI               string          `json:"client_uri,omitempty"`
+	LogoURI                 string          `json:"logo_uri,omitempty"`
+	TOSURI                  string          `json:"tos_uri,omitempty"`
+	PolicyURI               string          `json:"policy_uri,omitempty"`
+	JWKSURI                 string          `json:"jwks_uri,omitempty"`
+	JWKS                    json.RawMessage `json:"jwks,omitempty" swaggertype:"object"`
+	SoftwareID              string          `json:"software_id,omitempty"`
+	SoftwareVersion         string          `json:"software_version,omitempty"`
+	GrantTypes              []string        `json:"grant_types"`
+	ResponseTypes           []string        `json:"response_types"`
+	TokenEndpointAuthMethod string          `json:"token_endpoint_auth_method"`
+	Scope                   string          `json:"scope,omitempty"`
+	Contacts                []string        `json:"contacts,omitempty"`
+	RegistrationAccessToken string          `json:"registration_access_token"`
+	RegistrationClientURI   string          `json:"registration_client_uri"`
+}
diff --git a/codersdk/oauth2_validation.go b/codersdk/oauth2_validation.go
new file mode 100644
index 0000000000000..ad9375f4ef4a8
--- /dev/null
+++ b/codersdk/oauth2_validation.go
@@ -0,0 +1,276 @@
+package codersdk
+
+import (
+	"net/url"
+	"slices"
+	"strings"
+
+	"golang.org/x/xerrors"
+)
+
+// RFC 7591 validation functions for Dynamic Client Registration
+
+func (req *OAuth2ClientRegistrationRequest) Validate() error {
+	// Validate redirect URIs - required for authorization code flow
+	if len(req.RedirectURIs) == 0 {
+		return xerrors.New("redirect_uris is required for authorization code flow")
+	}
+
+	if err := validateRedirectURIs(req.RedirectURIs, req.TokenEndpointAuthMethod); err != nil {
+		return xerrors.Errorf("invalid redirect_uris: %w", err)
+	}
+
+	// Validate grant types if specified
+	if len(req.GrantTypes) > 0 {
+		if err := validateGrantTypes(req.GrantTypes); err != nil {
+			return xerrors.Errorf("invalid grant_types: %w", err)
+		}
+	}
+
+	// Validate response types if specified
+	if len(req.ResponseTypes) > 0 {
+		if err := validateResponseTypes(req.ResponseTypes); err != nil {
+			return xerrors.Errorf("invalid response_types: %w", err)
+		}
+	}
+
+	// Validate token endpoint auth method if specified
+	if req.TokenEndpointAuthMethod != "" {
+		if err := validateTokenEndpointAuthMethod(req.TokenEndpointAuthMethod); err != nil {
+			return xerrors.Errorf("invalid token_endpoint_auth_method: %w", err)
+		}
+	}
+
+	// Validate URI fields
+	if req.ClientURI != "" {
+		if err := validateURIField(req.ClientURI, "client_uri"); err != nil {
+			return err
+		}
+	}
+
+	if req.LogoURI != "" {
+		if err := validateURIField(req.LogoURI, "logo_uri"); err != nil {
+			return err
+		}
+	}
+
+	if req.TOSURI != "" {
+		if err := validateURIField(req.TOSURI, "tos_uri"); err != nil {
+			return err
+		}
+	}
+
+	if req.PolicyURI != "" {
+		if err := validateURIField(req.PolicyURI, "policy_uri"); err != nil {
+			return err
+		}
+	}
+
+	if req.JWKSURI != "" {
+		if err := validateURIField(req.JWKSURI, "jwks_uri"); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// validateRedirectURIs validates redirect URIs according to RFC 7591, 8252
+func validateRedirectURIs(uris []string, tokenEndpointAuthMethod string) error {
+	if len(uris) == 0 {
+		return xerrors.New("at least one redirect URI is required")
+	}
+
+	for i, uriStr := range uris {
+		if uriStr == "" {
+			return xerrors.Errorf("redirect URI at index %d cannot be empty", i)
+		}
+
+		uri, err := url.Parse(uriStr)
+		if err != nil {
+			return xerrors.Errorf("redirect URI at index %d is not a valid URL: %w", i, err)
+		}
+
+		// Validate schemes according to RFC requirements
+		if uri.Scheme == "" {
+			return xerrors.Errorf("redirect URI at index %d must have a scheme", i)
+		}
+
+		// Handle special URNs (RFC 6749 section 3.1.2.1)
+		if uri.Scheme == "urn" {
+			// Allow the out-of-band redirect URI for native apps
+			if uriStr == "urn:ietf:wg:oauth:2.0:oob" {
+				continue // This is valid for native apps
+			}
+			// Other URNs are not standard for OAuth2
+			return xerrors.Errorf("redirect URI at index %d uses unsupported URN scheme", i)
+		}
+
+		// Block dangerous schemes for security (not allowed by RFCs for OAuth2)
+		dangerousSchemes := []string{"javascript", "data", "file", "ftp"}
+		for _, dangerous := range dangerousSchemes {
+			if strings.EqualFold(uri.Scheme, dangerous) {
+				return xerrors.Errorf("redirect URI at index %d uses dangerous scheme %s which is not allowed", i, dangerous)
+			}
+		}
+
+		// Determine if this is a public client based on token endpoint auth method
+		isPublicClient := tokenEndpointAuthMethod == "none"
+
+		// Handle different validation for public vs confidential clients
+		if uri.Scheme == "http" || uri.Scheme == "https" {
+			// HTTP/HTTPS validation (RFC 8252 section 7.3)
+			if uri.Scheme == "http" {
+				if isPublicClient {
+					// For public clients, only allow loopback (RFC 8252)
+					if !isLoopbackAddress(uri.Hostname()) {
+						return xerrors.Errorf("redirect URI at index %d: public clients may only use http with loopback addresses (127.0.0.1, ::1, localhost)", i)
+					}
+				} else {
+					// For confidential clients, allow localhost for development
+					if !isLocalhost(uri.Hostname()) {
+						return xerrors.Errorf("redirect URI at index %d must use https scheme for non-localhost URLs", i)
+					}
+				}
+			}
+		} else {
+			// Custom scheme validation for public clients (RFC 8252 section 7.1)
+			if isPublicClient {
+				// For public clients, custom schemes should follow RFC 8252 recommendations
+				// Should be reverse domain notation based on domain under their control
+				if !isValidCustomScheme(uri.Scheme) {
+					return xerrors.Errorf("redirect URI at index %d: custom scheme %s should use reverse domain notation (e.g. com.example.app)", i, uri.Scheme)
+				}
+			}
+			// For confidential clients, custom schemes are less common but allowed
+		}
+
+		// Prevent URI fragments (RFC 6749 section 3.1.2)
+		if uri.Fragment != "" || strings.Contains(uriStr, "#") {
+			return xerrors.Errorf("redirect URI at index %d must not contain a fragment component", i)
+		}
+	}
+
+	return nil
+}
+
+// validateGrantTypes validates OAuth2 grant types
+func validateGrantTypes(grantTypes []string) error {
+	validGrants := []string{
+		string(OAuth2ProviderGrantTypeAuthorizationCode),
+		string(OAuth2ProviderGrantTypeRefreshToken),
+		// Add more grant types as they are implemented
+		// "client_credentials",
+		// "urn:ietf:params:oauth:grant-type:device_code",
+	}
+
+	for _, grant := range grantTypes {
+		if !slices.Contains(validGrants, grant) {
+			return xerrors.Errorf("unsupported grant type: %s", grant)
+		}
+	}
+
+	// Ensure authorization_code is present if redirect_uris are specified
+	hasAuthCode := slices.Contains(grantTypes, string(OAuth2ProviderGrantTypeAuthorizationCode))
+	if !hasAuthCode {
+		return xerrors.New("authorization_code grant type is required when redirect_uris are specified")
+	}
+
+	return nil
+}
+
+// validateResponseTypes validates OAuth2 response types
+func validateResponseTypes(responseTypes []string) error {
+	validResponses := []string{
+		string(OAuth2ProviderResponseTypeCode),
+		// Add more response types as they are implemented
+	}
+
+	for _, responseType := range responseTypes {
+		if !slices.Contains(validResponses, responseType) {
+			return xerrors.Errorf("unsupported response type: %s", responseType)
+		}
+	}
+
+	return nil
+}
+
+// validateTokenEndpointAuthMethod validates token endpoint authentication method
+func validateTokenEndpointAuthMethod(method string) error {
+	validMethods := []string{
+		"client_secret_post",
+		"client_secret_basic",
+		"none", // for public clients (RFC 7591)
+		// Add more methods as they are implemented
+		// "private_key_jwt",
+		// "client_secret_jwt",
+	}
+
+	if !slices.Contains(validMethods, method) {
+		return xerrors.Errorf("unsupported token endpoint auth method: %s", method)
+	}
+
+	return nil
+}
+
+// validateURIField validates a URI field
+func validateURIField(uriStr, fieldName string) error {
+	if uriStr == "" {
+		return nil // Empty URIs are allowed for optional fields
+	}
+
+	uri, err := url.Parse(uriStr)
+	if err != nil {
+		return xerrors.Errorf("invalid %s: %w", fieldName, err)
+	}
+
+	// Require absolute URLs with scheme
+	if !uri.IsAbs() {
+		return xerrors.Errorf("%s must be an absolute URL", fieldName)
+	}
+
+	// Only allow http/https schemes
+	if uri.Scheme != "http" && uri.Scheme != "https" {
+		return xerrors.Errorf("%s must use http or https scheme", fieldName)
+	}
+
+	// For production, prefer HTTPS
+	// Note: we allow HTTP for localhost but prefer HTTPS for production
+	// This could be made configurable in the future
+
+	return nil
+}
+
+// isLocalhost checks if hostname is localhost (allows broader development usage)
+func isLocalhost(hostname string) bool {
+	return hostname == "localhost" ||
+		hostname == "127.0.0.1" ||
+		hostname == "::1" ||
+		strings.HasSuffix(hostname, ".localhost")
+}
+
+// isLoopbackAddress checks if hostname is a strict loopback address (RFC 8252)
+func isLoopbackAddress(hostname string) bool {
+	return hostname == "localhost" ||
+		hostname == "127.0.0.1" ||
+		hostname == "::1"
+}
+
+// isValidCustomScheme validates custom schemes for public clients (RFC 8252)
+func isValidCustomScheme(scheme string) bool {
+	// For security and RFC compliance, require reverse domain notation
+	// Should contain at least one period and not be a well-known scheme
+	if !strings.Contains(scheme, ".") {
+		return false
+	}
+
+	// Block schemes that look like well-known protocols
+	wellKnownSchemes := []string{"http", "https", "ftp", "mailto", "tel", "sms"}
+	for _, wellKnown := range wellKnownSchemes {
+		if strings.EqualFold(scheme, wellKnown) {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/codersdk/toolsdk/toolsdk.go b/codersdk/toolsdk/toolsdk.go
index 24433c1b2a6da..4055674f6d2d3 100644
--- a/codersdk/toolsdk/toolsdk.go
+++ b/codersdk/toolsdk/toolsdk.go
@@ -15,6 +15,26 @@ import (
 	"github.com/coder/coder/v2/codersdk"
 )
 
+// Tool name constants to avoid hardcoded strings
+const (
+	ToolNameReportTask                  = "coder_report_task"
+	ToolNameGetWorkspace                = "coder_get_workspace"
+	ToolNameCreateWorkspace             = "coder_create_workspace"
+	ToolNameListWorkspaces              = "coder_list_workspaces"
+	ToolNameListTemplates               = "coder_list_templates"
+	ToolNameListTemplateVersionParams   = "coder_template_version_parameters"
+	ToolNameGetAuthenticatedUser        = "coder_get_authenticated_user"
+	ToolNameCreateWorkspaceBuild        = "coder_create_workspace_build"
+	ToolNameCreateTemplateVersion       = "coder_create_template_version"
+	ToolNameGetWorkspaceAgentLogs       = "coder_get_workspace_agent_logs"
+	ToolNameGetWorkspaceBuildLogs       = "coder_get_workspace_build_logs"
+	ToolNameGetTemplateVersionLogs      = "coder_get_template_version_logs"
+	ToolNameUpdateTemplateActiveVersion = "coder_update_template_active_version"
+	ToolNameUploadTarFile               = "coder_upload_tar_file"
+	ToolNameCreateTemplate              = "coder_create_template"
+	ToolNameDeleteTemplate              = "coder_delete_template"
+)
+
 func NewDeps(client *codersdk.Client, opts ...func(*Deps)) (Deps, error) {
 	d := Deps{
 		coderClient: client,
@@ -173,7 +193,7 @@ type ReportTaskArgs struct {
 
 var ReportTask = Tool[ReportTaskArgs, codersdk.Response]{
 	Tool: aisdk.Tool{
-		Name: "coder_report_task",
+		Name: ToolNameReportTask,
 		Description: `Report progress on your work.
 
 The user observes your work through a Task UI. To keep them updated
@@ -238,7 +258,7 @@ type GetWorkspaceArgs struct {
 
 var GetWorkspace = Tool[GetWorkspaceArgs, codersdk.Workspace]{
 	Tool: aisdk.Tool{
-		Name: "coder_get_workspace",
+		Name: ToolNameGetWorkspace,
 		Description: `Get a workspace by ID.
 
 This returns more data than list_workspaces to reduce token usage.`,
@@ -269,7 +289,7 @@ type CreateWorkspaceArgs struct {
 
 var CreateWorkspace = Tool[CreateWorkspaceArgs, codersdk.Workspace]{
 	Tool: aisdk.Tool{
-		Name: "coder_create_workspace",
+		Name: ToolNameCreateWorkspace,
 		Description: `Create a new workspace in Coder.
 
 If a user is asking to "test a template", they are typically referring
@@ -331,7 +351,7 @@ type ListWorkspacesArgs struct {
 
 var ListWorkspaces = Tool[ListWorkspacesArgs, []MinimalWorkspace]{
 	Tool: aisdk.Tool{
-		Name:        "coder_list_workspaces",
+		Name:        ToolNameListWorkspaces,
 		Description: "Lists workspaces for the authenticated user.",
 		Schema: aisdk.Schema{
 			Properties: map[string]any{
@@ -373,7 +393,7 @@ var ListWorkspaces = Tool[ListWorkspacesArgs, []MinimalWorkspace]{
 
 var ListTemplates = Tool[NoArgs, []MinimalTemplate]{
 	Tool: aisdk.Tool{
-		Name:        "coder_list_templates",
+		Name:        ToolNameListTemplates,
 		Description: "Lists templates for the authenticated user.",
 		Schema: aisdk.Schema{
 			Properties: map[string]any{},
@@ -406,7 +426,7 @@ type ListTemplateVersionParametersArgs struct {
 
 var ListTemplateVersionParameters = Tool[ListTemplateVersionParametersArgs, []codersdk.TemplateVersionParameter]{
 	Tool: aisdk.Tool{
-		Name:        "coder_template_version_parameters",
+		Name:        ToolNameListTemplateVersionParams,
 		Description: "Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.",
 		Schema: aisdk.Schema{
 			Properties: map[string]any{
@@ -432,7 +452,7 @@ var ListTemplateVersionParameters = Tool[ListTemplateVersionParametersArgs, []co
 
 var GetAuthenticatedUser = Tool[NoArgs, codersdk.User]{
 	Tool: aisdk.Tool{
-		Name:        "coder_get_authenticated_user",
+		Name:        ToolNameGetAuthenticatedUser,
 		Description: "Get the currently authenticated user, similar to the `whoami` command.",
 		Schema: aisdk.Schema{
 			Properties: map[string]any{},
@@ -452,7 +472,7 @@ type CreateWorkspaceBuildArgs struct {
 
 var CreateWorkspaceBuild = Tool[CreateWorkspaceBuildArgs, codersdk.WorkspaceBuild]{
 	Tool: aisdk.Tool{
-		Name:        "coder_create_workspace_build",
+		Name:        ToolNameCreateWorkspaceBuild,
 		Description: "Create a new workspace build for an existing workspace. Use this to start, stop, or delete.",
 		Schema: aisdk.Schema{
 			Properties: map[string]any{
@@ -502,7 +522,7 @@ type CreateTemplateVersionArgs struct {
 
 var CreateTemplateVersion = Tool[CreateTemplateVersionArgs, codersdk.TemplateVersion]{
 	Tool: aisdk.Tool{
-		Name: "coder_create_template_version",
+		Name: ToolNameCreateTemplateVersion,
 		Description: `Create a new template version. This is a precursor to creating a template, or you can update an existing template.
 
 Templates are Terraform defining a development environment. The provisioned infrastructure must run
@@ -1002,7 +1022,7 @@ type GetWorkspaceAgentLogsArgs struct {
 
 var GetWorkspaceAgentLogs = Tool[GetWorkspaceAgentLogsArgs, []string]{
 	Tool: aisdk.Tool{
-		Name: "coder_get_workspace_agent_logs",
+		Name: ToolNameGetWorkspaceAgentLogs,
 		Description: `Get the logs of a workspace agent.
 
 		More logs may appear after this call. It does not wait for the agent to finish.`,
@@ -1041,7 +1061,7 @@ type GetWorkspaceBuildLogsArgs struct {
 
 var GetWorkspaceBuildLogs = Tool[GetWorkspaceBuildLogsArgs, []string]{
 	Tool: aisdk.Tool{
-		Name: "coder_get_workspace_build_logs",
+		Name: ToolNameGetWorkspaceBuildLogs,
 		Description: `Get the logs of a workspace build.
 
 		Useful for checking whether a workspace builds successfully or not.`,
@@ -1078,7 +1098,7 @@ type GetTemplateVersionLogsArgs struct {
 
 var GetTemplateVersionLogs = Tool[GetTemplateVersionLogsArgs, []string]{
 	Tool: aisdk.Tool{
-		Name:        "coder_get_template_version_logs",
+		Name:        ToolNameGetTemplateVersionLogs,
 		Description: "Get the logs of a template version. This is useful to check whether a template version successfully imports or not.",
 		Schema: aisdk.Schema{
 			Properties: map[string]any{
@@ -1115,7 +1135,7 @@ type UpdateTemplateActiveVersionArgs struct {
 
 var UpdateTemplateActiveVersion = Tool[UpdateTemplateActiveVersionArgs, string]{
 	Tool: aisdk.Tool{
-		Name:        "coder_update_template_active_version",
+		Name:        ToolNameUpdateTemplateActiveVersion,
 		Description: "Update the active version of a template. This is helpful when iterating on templates.",
 		Schema: aisdk.Schema{
 			Properties: map[string]any{
@@ -1154,7 +1174,7 @@ type UploadTarFileArgs struct {
 
 var UploadTarFile = Tool[UploadTarFileArgs, codersdk.UploadResponse]{
 	Tool: aisdk.Tool{
-		Name:        "coder_upload_tar_file",
+		Name:        ToolNameUploadTarFile,
 		Description: `Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of "create_template_version" to understand template requirements.`,
 		Schema: aisdk.Schema{
 			Properties: map[string]any{
@@ -1216,7 +1236,7 @@ type CreateTemplateArgs struct {
 
 var CreateTemplate = Tool[CreateTemplateArgs, codersdk.Template]{
 	Tool: aisdk.Tool{
-		Name:        "coder_create_template",
+		Name:        ToolNameCreateTemplate,
 		Description: "Create a new template in Coder. First, you must create a template version.",
 		Schema: aisdk.Schema{
 			Properties: map[string]any{
@@ -1269,7 +1289,7 @@ type DeleteTemplateArgs struct {
 
 var DeleteTemplate = Tool[DeleteTemplateArgs, codersdk.Response]{
 	Tool: aisdk.Tool{
-		Name:        "coder_delete_template",
+		Name:        ToolNameDeleteTemplate,
 		Description: "Delete a template. This is irreversible.",
 		Schema: aisdk.Schema{
 			Properties: map[string]any{
diff --git a/docs/admin/security/audit-logs.md b/docs/admin/security/audit-logs.md
index 868a2565e93a9..af033d02df2d5 100644
--- a/docs/admin/security/audit-logs.md
+++ b/docs/admin/security/audit-logs.md
@@ -21,7 +21,7 @@ We track the following resources:
 | License<br><i>create, delete</i>                         | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>exp</td><td>true</td></tr><tr><td>id</td><td>false</td></tr><tr><td>jwt</td><td>false</td></tr><tr><td>uploaded_at</td><td>true</td></tr><tr><td>uuid</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | NotificationTemplate<br><i></i>                          | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>actions</td><td>true</td></tr><tr><td>body_template</td><td>true</td></tr><tr><td>enabled_by_default</td><td>true</td></tr><tr><td>group</td><td>true</td></tr><tr><td>id</td><td>false</td></tr><tr><td>kind</td><td>true</td></tr><tr><td>method</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>title_template</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | NotificationsSettings<br><i></i>                         | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>id</td><td>false</td></tr><tr><td>notifier_paused</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| OAuth2ProviderApp<br><i></i>                             | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>callback_url</td><td>true</td></tr><tr><td>client_type</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>dynamically_registered</td><td>true</td></tr><tr><td>icon</td><td>true</td></tr><tr><td>id</td><td>false</td></tr><tr><td>name</td><td>true</td></tr><tr><td>redirect_uris</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| OAuth2ProviderApp<br><i></i>                             | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>callback_url</td><td>true</td></tr><tr><td>client_id_issued_at</td><td>false</td></tr><tr><td>client_secret_expires_at</td><td>true</td></tr><tr><td>client_type</td><td>true</td></tr><tr><td>client_uri</td><td>true</td></tr><tr><td>contacts</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>dynamically_registered</td><td>true</td></tr><tr><td>grant_types</td><td>true</td></tr><tr><td>icon</td><td>true</td></tr><tr><td>id</td><td>false</td></tr><tr><td>jwks</td><td>true</td></tr><tr><td>jwks_uri</td><td>true</td></tr><tr><td>logo_uri</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>policy_uri</td><td>true</td></tr><tr><td>redirect_uris</td><td>true</td></tr><tr><td>registration_access_token</td><td>true</td></tr><tr><td>registration_client_uri</td><td>true</td></tr><tr><td>response_types</td><td>true</td></tr><tr><td>scope</td><td>true</td></tr><tr><td>software_id</td><td>true</td></tr><tr><td>software_version</td><td>true</td></tr><tr><td>token_endpoint_auth_method</td><td>true</td></tr><tr><td>tos_uri</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | OAuth2ProviderAppSecret<br><i></i>                       | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>app_id</td><td>false</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>display_secret</td><td>false</td></tr><tr><td>hashed_secret</td><td>false</td></tr><tr><td>id</td><td>false</td></tr><tr><td>last_used_at</td><td>false</td></tr><tr><td>secret_prefix</td><td>false</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | Organization<br><i></i>                                  | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>created_at</td><td>false</td></tr><tr><td>deleted</td><td>true</td></tr><tr><td>description</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>icon</td><td>true</td></tr><tr><td>id</td><td>false</td></tr><tr><td>is_default</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>updated_at</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | OrganizationSyncSettings<br><i></i>                      | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>assign_default</td><td>true</td></tr><tr><td>field</td><td>true</td></tr><tr><td>mapping</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
diff --git a/docs/reference/api/enterprise.md b/docs/reference/api/enterprise.md
index c885383a0fd35..f1ff4a0baec7a 100644
--- a/docs/reference/api/enterprise.md
+++ b/docs/reference/api/enterprise.md
@@ -1122,6 +1122,279 @@ curl -X POST http://coder-server:8080/api/v2/oauth2/authorize?client_id=string&s
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
+## Get OAuth2 client configuration (RFC 7592)
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X GET http://coder-server:8080/api/v2/oauth2/clients/{client_id} \
+  -H 'Accept: application/json'
+```
+
+`GET /oauth2/clients/{client_id}`
+
+### Parameters
+
+| Name        | In   | Type   | Required | Description |
+|-------------|------|--------|----------|-------------|
+| `client_id` | path | string | true     | Client ID   |
+
+### Example responses
+
+> 200 Response
+
+```json
+{
+  "client_id": "string",
+  "client_id_issued_at": 0,
+  "client_name": "string",
+  "client_secret_expires_at": 0,
+  "client_uri": "string",
+  "contacts": [
+    "string"
+  ],
+  "grant_types": [
+    "string"
+  ],
+  "jwks": {},
+  "jwks_uri": "string",
+  "logo_uri": "string",
+  "policy_uri": "string",
+  "redirect_uris": [
+    "string"
+  ],
+  "registration_access_token": "string",
+  "registration_client_uri": "string",
+  "response_types": [
+    "string"
+  ],
+  "scope": "string",
+  "software_id": "string",
+  "software_version": "string",
+  "token_endpoint_auth_method": "string",
+  "tos_uri": "string"
+}
+```
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                                                             |
+|--------|---------------------------------------------------------|-------------|------------------------------------------------------------------------------------|
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.OAuth2ClientConfiguration](schemas.md#codersdkoauth2clientconfiguration) |
+
+## Update OAuth2 client configuration (RFC 7592)
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X PUT http://coder-server:8080/api/v2/oauth2/clients/{client_id} \
+  -H 'Content-Type: application/json' \
+  -H 'Accept: application/json'
+```
+
+`PUT /oauth2/clients/{client_id}`
+
+> Body parameter
+
+```json
+{
+  "client_name": "string",
+  "client_uri": "string",
+  "contacts": [
+    "string"
+  ],
+  "grant_types": [
+    "string"
+  ],
+  "jwks": {},
+  "jwks_uri": "string",
+  "logo_uri": "string",
+  "policy_uri": "string",
+  "redirect_uris": [
+    "string"
+  ],
+  "response_types": [
+    "string"
+  ],
+  "scope": "string",
+  "software_id": "string",
+  "software_statement": "string",
+  "software_version": "string",
+  "token_endpoint_auth_method": "string",
+  "tos_uri": "string"
+}
+```
+
+### Parameters
+
+| Name        | In   | Type                                                                                           | Required | Description           |
+|-------------|------|------------------------------------------------------------------------------------------------|----------|-----------------------|
+| `client_id` | path | string                                                                                         | true     | Client ID             |
+| `body`      | body | [codersdk.OAuth2ClientRegistrationRequest](schemas.md#codersdkoauth2clientregistrationrequest) | true     | Client update request |
+
+### Example responses
+
+> 200 Response
+
+```json
+{
+  "client_id": "string",
+  "client_id_issued_at": 0,
+  "client_name": "string",
+  "client_secret_expires_at": 0,
+  "client_uri": "string",
+  "contacts": [
+    "string"
+  ],
+  "grant_types": [
+    "string"
+  ],
+  "jwks": {},
+  "jwks_uri": "string",
+  "logo_uri": "string",
+  "policy_uri": "string",
+  "redirect_uris": [
+    "string"
+  ],
+  "registration_access_token": "string",
+  "registration_client_uri": "string",
+  "response_types": [
+    "string"
+  ],
+  "scope": "string",
+  "software_id": "string",
+  "software_version": "string",
+  "token_endpoint_auth_method": "string",
+  "tos_uri": "string"
+}
+```
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                                                             |
+|--------|---------------------------------------------------------|-------------|------------------------------------------------------------------------------------|
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.OAuth2ClientConfiguration](schemas.md#codersdkoauth2clientconfiguration) |
+
+## Delete OAuth2 client registration (RFC 7592)
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X DELETE http://coder-server:8080/api/v2/oauth2/clients/{client_id}
+
+```
+
+`DELETE /oauth2/clients/{client_id}`
+
+### Parameters
+
+| Name        | In   | Type   | Required | Description |
+|-------------|------|--------|----------|-------------|
+| `client_id` | path | string | true     | Client ID   |
+
+### Responses
+
+| Status | Meaning                                                         | Description | Schema |
+|--------|-----------------------------------------------------------------|-------------|--------|
+| 204    | [No Content](https://tools.ietf.org/html/rfc7231#section-6.3.5) | No Content  |        |
+
+## OAuth2 dynamic client registration (RFC 7591)
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X POST http://coder-server:8080/api/v2/oauth2/register \
+  -H 'Content-Type: application/json' \
+  -H 'Accept: application/json'
+```
+
+`POST /oauth2/register`
+
+> Body parameter
+
+```json
+{
+  "client_name": "string",
+  "client_uri": "string",
+  "contacts": [
+    "string"
+  ],
+  "grant_types": [
+    "string"
+  ],
+  "jwks": {},
+  "jwks_uri": "string",
+  "logo_uri": "string",
+  "policy_uri": "string",
+  "redirect_uris": [
+    "string"
+  ],
+  "response_types": [
+    "string"
+  ],
+  "scope": "string",
+  "software_id": "string",
+  "software_statement": "string",
+  "software_version": "string",
+  "token_endpoint_auth_method": "string",
+  "tos_uri": "string"
+}
+```
+
+### Parameters
+
+| Name   | In   | Type                                                                                           | Required | Description                 |
+|--------|------|------------------------------------------------------------------------------------------------|----------|-----------------------------|
+| `body` | body | [codersdk.OAuth2ClientRegistrationRequest](schemas.md#codersdkoauth2clientregistrationrequest) | true     | Client registration request |
+
+### Example responses
+
+> 201 Response
+
+```json
+{
+  "client_id": "string",
+  "client_id_issued_at": 0,
+  "client_name": "string",
+  "client_secret": "string",
+  "client_secret_expires_at": 0,
+  "client_uri": "string",
+  "contacts": [
+    "string"
+  ],
+  "grant_types": [
+    "string"
+  ],
+  "jwks": {},
+  "jwks_uri": "string",
+  "logo_uri": "string",
+  "policy_uri": "string",
+  "redirect_uris": [
+    "string"
+  ],
+  "registration_access_token": "string",
+  "registration_client_uri": "string",
+  "response_types": [
+    "string"
+  ],
+  "scope": "string",
+  "software_id": "string",
+  "software_version": "string",
+  "token_endpoint_auth_method": "string",
+  "tos_uri": "string"
+}
+```
+
+### Responses
+
+| Status | Meaning                                                      | Description | Schema                                                                                           |
+|--------|--------------------------------------------------------------|-------------|--------------------------------------------------------------------------------------------------|
+| 201    | [Created](https://tools.ietf.org/html/rfc7231#section-6.3.2) | Created     | [codersdk.OAuth2ClientRegistrationResponse](schemas.md#codersdkoauth2clientregistrationresponse) |
+
 ## OAuth2 token exchange
 
 ### Code samples
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 2a5c9ed380441..281a3a8a19e61 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -1366,12 +1366,52 @@ This is required on creation to enable a user-flow of validating a template work
 ## codersdk.CreateTestAuditLogRequest
 
 ```json
-{}
+{
+  "action": "create",
+  "additional_fields": [
+    0
+  ],
+  "build_reason": "autostart",
+  "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+  "request_id": "266ea41d-adf5-480b-af50-15b940c2b846",
+  "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
+  "resource_type": "template",
+  "time": "2019-08-24T14:15:22Z"
+}
 ```
 
 ### Properties
 
-None
+| Name                | Type                                           | Required | Restrictions | Description |
+|---------------------|------------------------------------------------|----------|--------------|-------------|
+| `action`            | [codersdk.AuditAction](#codersdkauditaction)   | false    |              |             |
+| `additional_fields` | array of integer                               | false    |              |             |
+| `build_reason`      | [codersdk.BuildReason](#codersdkbuildreason)   | false    |              |             |
+| `organization_id`   | string                                         | false    |              |             |
+| `request_id`        | string                                         | false    |              |             |
+| `resource_id`       | string                                         | false    |              |             |
+| `resource_type`     | [codersdk.ResourceType](#codersdkresourcetype) | false    |              |             |
+| `time`              | string                                         | false    |              |             |
+
+#### Enumerated Values
+
+| Property        | Value              |
+|-----------------|--------------------|
+| `action`        | `create`           |
+| `action`        | `write`            |
+| `action`        | `delete`           |
+| `action`        | `start`            |
+| `action`        | `stop`             |
+| `build_reason`  | `autostart`        |
+| `build_reason`  | `autostop`         |
+| `build_reason`  | `initiator`        |
+| `resource_type` | `template`         |
+| `resource_type` | `template_version` |
+| `resource_type` | `user`             |
+| `resource_type` | `workspace`        |
+| `resource_type` | `workspace_build`  |
+| `resource_type` | `git_ssh_key`      |
+| `resource_type` | `auditable_group`  |
 
 ## codersdk.CreateTokenRequest
 
@@ -2999,6 +3039,8 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
 | `notifications`        |
 | `workspace-usage`      |
 | `web-push`             |
+| `oauth2`               |
+| `mcp-server-http`      |
 
 ## codersdk.ExternalAuth
 
@@ -4225,6 +4267,180 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith
 | `token_endpoint`                        | string          | false    |              |             |
 | `token_endpoint_auth_methods_supported` | array of string | false    |              |             |
 
+## codersdk.OAuth2ClientConfiguration
+
+```json
+{
+  "client_id": "string",
+  "client_id_issued_at": 0,
+  "client_name": "string",
+  "client_secret_expires_at": 0,
+  "client_uri": "string",
+  "contacts": [
+    "string"
+  ],
+  "grant_types": [
+    "string"
+  ],
+  "jwks": {},
+  "jwks_uri": "string",
+  "logo_uri": "string",
+  "policy_uri": "string",
+  "redirect_uris": [
+    "string"
+  ],
+  "registration_access_token": "string",
+  "registration_client_uri": "string",
+  "response_types": [
+    "string"
+  ],
+  "scope": "string",
+  "software_id": "string",
+  "software_version": "string",
+  "token_endpoint_auth_method": "string",
+  "tos_uri": "string"
+}
+```
+
+### Properties
+
+| Name                         | Type            | Required | Restrictions | Description |
+|------------------------------|-----------------|----------|--------------|-------------|
+| `client_id`                  | string          | false    |              |             |
+| `client_id_issued_at`        | integer         | false    |              |             |
+| `client_name`                | string          | false    |              |             |
+| `client_secret_expires_at`   | integer         | false    |              |             |
+| `client_uri`                 | string          | false    |              |             |
+| `contacts`                   | array of string | false    |              |             |
+| `grant_types`                | array of string | false    |              |             |
+| `jwks`                       | object          | false    |              |             |
+| `jwks_uri`                   | string          | false    |              |             |
+| `logo_uri`                   | string          | false    |              |             |
+| `policy_uri`                 | string          | false    |              |             |
+| `redirect_uris`              | array of string | false    |              |             |
+| `registration_access_token`  | string          | false    |              |             |
+| `registration_client_uri`    | string          | false    |              |             |
+| `response_types`             | array of string | false    |              |             |
+| `scope`                      | string          | false    |              |             |
+| `software_id`                | string          | false    |              |             |
+| `software_version`           | string          | false    |              |             |
+| `token_endpoint_auth_method` | string          | false    |              |             |
+| `tos_uri`                    | string          | false    |              |             |
+
+## codersdk.OAuth2ClientRegistrationRequest
+
+```json
+{
+  "client_name": "string",
+  "client_uri": "string",
+  "contacts": [
+    "string"
+  ],
+  "grant_types": [
+    "string"
+  ],
+  "jwks": {},
+  "jwks_uri": "string",
+  "logo_uri": "string",
+  "policy_uri": "string",
+  "redirect_uris": [
+    "string"
+  ],
+  "response_types": [
+    "string"
+  ],
+  "scope": "string",
+  "software_id": "string",
+  "software_statement": "string",
+  "software_version": "string",
+  "token_endpoint_auth_method": "string",
+  "tos_uri": "string"
+}
+```
+
+### Properties
+
+| Name                         | Type            | Required | Restrictions | Description |
+|------------------------------|-----------------|----------|--------------|-------------|
+| `client_name`                | string          | false    |              |             |
+| `client_uri`                 | string          | false    |              |             |
+| `contacts`                   | array of string | false    |              |             |
+| `grant_types`                | array of string | false    |              |             |
+| `jwks`                       | object          | false    |              |             |
+| `jwks_uri`                   | string          | false    |              |             |
+| `logo_uri`                   | string          | false    |              |             |
+| `policy_uri`                 | string          | false    |              |             |
+| `redirect_uris`              | array of string | false    |              |             |
+| `response_types`             | array of string | false    |              |             |
+| `scope`                      | string          | false    |              |             |
+| `software_id`                | string          | false    |              |             |
+| `software_statement`         | string          | false    |              |             |
+| `software_version`           | string          | false    |              |             |
+| `token_endpoint_auth_method` | string          | false    |              |             |
+| `tos_uri`                    | string          | false    |              |             |
+
+## codersdk.OAuth2ClientRegistrationResponse
+
+```json
+{
+  "client_id": "string",
+  "client_id_issued_at": 0,
+  "client_name": "string",
+  "client_secret": "string",
+  "client_secret_expires_at": 0,
+  "client_uri": "string",
+  "contacts": [
+    "string"
+  ],
+  "grant_types": [
+    "string"
+  ],
+  "jwks": {},
+  "jwks_uri": "string",
+  "logo_uri": "string",
+  "policy_uri": "string",
+  "redirect_uris": [
+    "string"
+  ],
+  "registration_access_token": "string",
+  "registration_client_uri": "string",
+  "response_types": [
+    "string"
+  ],
+  "scope": "string",
+  "software_id": "string",
+  "software_version": "string",
+  "token_endpoint_auth_method": "string",
+  "tos_uri": "string"
+}
+```
+
+### Properties
+
+| Name                         | Type            | Required | Restrictions | Description |
+|------------------------------|-----------------|----------|--------------|-------------|
+| `client_id`                  | string          | false    |              |             |
+| `client_id_issued_at`        | integer         | false    |              |             |
+| `client_name`                | string          | false    |              |             |
+| `client_secret`              | string          | false    |              |             |
+| `client_secret_expires_at`   | integer         | false    |              |             |
+| `client_uri`                 | string          | false    |              |             |
+| `contacts`                   | array of string | false    |              |             |
+| `grant_types`                | array of string | false    |              |             |
+| `jwks`                       | object          | false    |              |             |
+| `jwks_uri`                   | string          | false    |              |             |
+| `logo_uri`                   | string          | false    |              |             |
+| `policy_uri`                 | string          | false    |              |             |
+| `redirect_uris`              | array of string | false    |              |             |
+| `registration_access_token`  | string          | false    |              |             |
+| `registration_client_uri`    | string          | false    |              |             |
+| `response_types`             | array of string | false    |              |             |
+| `scope`                      | string          | false    |              |             |
+| `software_id`                | string          | false    |              |             |
+| `software_version`           | string          | false    |              |             |
+| `token_endpoint_auth_method` | string          | false    |              |             |
+| `tos_uri`                    | string          | false    |              |             |
+
 ## codersdk.OAuth2Config
 
 ```json
diff --git a/enterprise/audit/table.go b/enterprise/audit/table.go
index ee71149cdbc50..2a563946dc347 100644
--- a/enterprise/audit/table.go
+++ b/enterprise/audit/table.go
@@ -275,6 +275,25 @@ var auditableResourcesTypes = map[any]map[string]Action{
 		"redirect_uris":          ActionTrack,
 		"client_type":            ActionTrack,
 		"dynamically_registered": ActionTrack,
+		// RFC 7591 Dynamic Client Registration fields
+		"client_id_issued_at":        ActionIgnore, // Timestamp, not security relevant
+		"client_secret_expires_at":   ActionTrack,  // Security relevant - expiration policy
+		"grant_types":                ActionTrack,  // Security relevant - authorization capabilities
+		"response_types":             ActionTrack,  // Security relevant - response flow types
+		"token_endpoint_auth_method": ActionTrack,  // Security relevant - auth method
+		"scope":                      ActionTrack,  // Security relevant - permissions scope
+		"contacts":                   ActionTrack,  // Contact info for responsible parties
+		"client_uri":                 ActionTrack,  // Client identification info
+		"logo_uri":                   ActionTrack,  // Client branding
+		"tos_uri":                    ActionTrack,  // Legal compliance
+		"policy_uri":                 ActionTrack,  // Legal compliance
+		"jwks_uri":                   ActionTrack,  // Security relevant - key location
+		"jwks":                       ActionSecret, // Security sensitive - actual keys
+		"software_id":                ActionTrack,  // Client software identification
+		"software_version":           ActionTrack,  // Client software version
+		// RFC 7592 Management fields - sensitive data
+		"registration_access_token": ActionSecret, // Secret token for client management
+		"registration_client_uri":   ActionTrack,  // Management endpoint URI
 	},
 	&database.OAuth2ProviderAppSecret{}: {
 		"id":             ActionIgnore,
diff --git a/enterprise/coderd/dynamicparameters_test.go b/enterprise/coderd/dynamicparameters_test.go
index 87d115034f247..e13d370a059ad 100644
--- a/enterprise/coderd/dynamicparameters_test.go
+++ b/enterprise/coderd/dynamicparameters_test.go
@@ -25,7 +25,9 @@ func TestDynamicParameterBuild(t *testing.T) {
 	t.Parallel()
 
 	owner, _, _, first := coderdenttest.NewWithAPI(t, &coderdenttest.Options{
-		Options: &coderdtest.Options{IncludeProvisionerDaemon: true},
+		Options: &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+		},
 		LicenseOptions: &coderdenttest.LicenseOptions{
 			Features: license.Features{
 				codersdk.FeatureTemplateRBAC: 1,
@@ -355,6 +357,92 @@ func TestDynamicParameterBuild(t *testing.T) {
 	})
 }
 
+func TestDynamicWorkspaceTags(t *testing.T) {
+	t.Parallel()
+
+	owner, _, _, first := coderdenttest.NewWithAPI(t, &coderdenttest.Options{
+		Options: &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+		},
+		LicenseOptions: &coderdenttest.LicenseOptions{
+			Features: license.Features{
+				codersdk.FeatureTemplateRBAC:               1,
+				codersdk.FeatureExternalProvisionerDaemons: 1,
+			},
+		},
+	})
+
+	orgID := first.OrganizationID
+
+	templateAdmin, _ := coderdtest.CreateAnotherUser(t, owner, orgID, rbac.ScopedRoleOrgTemplateAdmin(orgID))
+	// create the template first, mark it as dynamic, then create the second version with the workspace tags.
+	// This ensures the template import uses the dynamic tags flow. The second step will happen in a test below.
+	workspaceTags, _ := coderdtest.DynamicParameterTemplate(t, templateAdmin, orgID, coderdtest.DynamicParameterTemplateParams{
+		MainTF: ``,
+	})
+
+	expectedTags := map[string]string{
+		"function":    "param is foo",
+		"stringvar":   "bar",
+		"numvar":      "42",
+		"boolvar":     "true",
+		"stringparam": "foo",
+		"numparam":    "7",
+		"boolparam":   "true",
+		"listparam":   `["a","b"]`,
+		"static":      "static value",
+	}
+
+	// A new provisioner daemon is required to make the template version.
+	importProvisioner := coderdenttest.NewExternalProvisionerDaemon(t, owner, first.OrganizationID, expectedTags)
+	defer importProvisioner.Close()
+
+	// This tests the template import's workspace tags extraction.
+	workspaceTags, workspaceTagsVersion := coderdtest.DynamicParameterTemplate(t, templateAdmin, orgID, coderdtest.DynamicParameterTemplateParams{
+		MainTF:     string(must(os.ReadFile("testdata/parameters/workspacetags/main.tf"))),
+		TemplateID: workspaceTags.ID,
+		Version: func(request *codersdk.CreateTemplateVersionRequest) {
+			request.ProvisionerTags = map[string]string{
+				"static": "static value",
+			}
+		},
+	})
+	importProvisioner.Close() // No longer need this provisioner daemon, as the template import is done.
+
+	// Test the workspace create tag extraction.
+	expectedTags["function"] = "param is baz"
+	expectedTags["stringparam"] = "baz"
+	expectedTags["numparam"] = "8"
+	expectedTags["boolparam"] = "false"
+	workspaceProvisioner := coderdenttest.NewExternalProvisionerDaemon(t, owner, first.OrganizationID, expectedTags)
+	defer workspaceProvisioner.Close()
+
+	ctx := testutil.Context(t, testutil.WaitShort)
+	wrk, err := templateAdmin.CreateUserWorkspace(ctx, codersdk.Me, codersdk.CreateWorkspaceRequest{
+		TemplateVersionID: workspaceTagsVersion.ID,
+		Name:              coderdtest.RandomUsername(t),
+		RichParameterValues: []codersdk.WorkspaceBuildParameter{
+			{Name: "stringparam", Value: "baz"},
+			{Name: "numparam", Value: "8"},
+			{Name: "boolparam", Value: "false"},
+		},
+	})
+	require.NoError(t, err)
+
+	build, err := templateAdmin.WorkspaceBuild(ctx, wrk.LatestBuild.ID)
+	require.NoError(t, err)
+
+	job, err := templateAdmin.OrganizationProvisionerJob(ctx, first.OrganizationID, build.Job.ID)
+	require.NoError(t, err)
+
+	// If the tags do no match, the await will fail.
+	// 'scope' and 'owner' tags are always included.
+	expectedTags["scope"] = "organization"
+	expectedTags["owner"] = ""
+	require.Equal(t, expectedTags, job.Tags)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, templateAdmin, wrk.LatestBuild.ID)
+}
+
 // TestDynamicParameterTemplate uses a template with some dynamic elements, and
 // tests the parameters, values, etc are all as expected.
 func TestDynamicParameterTemplate(t *testing.T) {
diff --git a/enterprise/coderd/testdata/parameters/workspacetags/main.tf b/enterprise/coderd/testdata/parameters/workspacetags/main.tf
new file mode 100644
index 0000000000000..f322f24bb1200
--- /dev/null
+++ b/enterprise/coderd/testdata/parameters/workspacetags/main.tf
@@ -0,0 +1,66 @@
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+  }
+}
+
+
+variable "stringvar" {
+  type    = string
+  default = "bar"
+}
+
+variable "numvar" {
+  type    = number
+  default = 42
+}
+
+variable "boolvar" {
+  type    = bool
+  default = true
+}
+
+data "coder_parameter" "stringparam" {
+  name    = "stringparam"
+  type    = "string"
+  default = "foo"
+}
+
+data "coder_parameter" "stringparamref" {
+  name    = "stringparamref"
+  type    = "string"
+  default = data.coder_parameter.stringparam.value
+}
+
+data "coder_parameter" "numparam" {
+  name    = "numparam"
+  type    = "number"
+  default = 7
+}
+
+data "coder_parameter" "boolparam" {
+  name    = "boolparam"
+  type    = "bool"
+  default = true
+}
+
+data "coder_parameter" "listparam" {
+  name    = "listparam"
+  type    = "list(string)"
+  default = jsonencode(["a", "b"])
+}
+
+data "coder_workspace_tags" "tags" {
+  tags = {
+    "function"    = format("param is %s", data.coder_parameter.stringparamref.value)
+    "stringvar"   = var.stringvar
+    "numvar"      = var.numvar
+    "boolvar"     = var.boolvar
+    "stringparam" = data.coder_parameter.stringparam.value
+    "numparam"    = data.coder_parameter.numparam.value
+    "boolparam"   = data.coder_parameter.boolparam.value
+    "listparam"   = data.coder_parameter.listparam.value
+  }
+}
diff --git a/go.mod b/go.mod
index cd92b8f3a36dd..704ba33b14e55 100644
--- a/go.mod
+++ b/go.mod
@@ -206,7 +206,7 @@ require (
 	golang.org/x/sync v0.14.0
 	golang.org/x/sys v0.33.0
 	golang.org/x/term v0.32.0
-	golang.org/x/text v0.25.0 // indirect
+	golang.org/x/text v0.25.0
 	golang.org/x/tools v0.33.0
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
 	google.golang.org/api v0.231.0
@@ -483,7 +483,7 @@ require (
 require (
 	github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225
 	github.com/coder/aisdk-go v0.0.9
-	github.com/coder/preview v1.0.2
+	github.com/coder/preview v1.0.3-0.20250701142654-c3d6e86b9393
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/mark3labs/mcp-go v0.32.0
 )
diff --git a/go.sum b/go.sum
index 537a2747e797a..ccab4d93c703d 100644
--- a/go.sum
+++ b/go.sum
@@ -916,8 +916,8 @@ github.com/coder/pq v1.10.5-0.20250630052411-a259f96b6102 h1:ahTJlTRmTogsubgRVGO
 github.com/coder/pq v1.10.5-0.20250630052411-a259f96b6102/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 h1:3A0ES21Ke+FxEM8CXx9n47SZOKOpgSE1bbJzlE4qPVs=
 github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0/go.mod h1:5UuS2Ts+nTToAMeOjNlnHFkPahrtDkmpydBen/3wgZc=
-github.com/coder/preview v1.0.2 h1:ZFfox0PgXcIouB9iWGcZyOtdL0h2a4ju1iPw/dMqsg4=
-github.com/coder/preview v1.0.2/go.mod h1:efDWGlO/PZPrvdt5QiDhMtTUTkPxejXo9c0wmYYLLjM=
+github.com/coder/preview v1.0.3-0.20250701142654-c3d6e86b9393 h1:l+m2liikn8JoEv6C22QIV4qseolUfvNsyUNA6JJsD6Y=
+github.com/coder/preview v1.0.3-0.20250701142654-c3d6e86b9393/go.mod h1:efDWGlO/PZPrvdt5QiDhMtTUTkPxejXo9c0wmYYLLjM=
 github.com/coder/quartz v0.2.1 h1:QgQ2Vc1+mvzewg2uD/nj8MJ9p9gE+QhGJm+Z+NGnrSE=
 github.com/coder/quartz v0.2.1/go.mod h1:vsiCc+AHViMKH2CQpGIpFgdHIEQsxwm8yCscqKmzbRA=
 github.com/coder/retry v1.5.1 h1:iWu8YnD8YqHs3XwqrqsjoBTAVqT9ml6z9ViJ2wlMiqc=
diff --git a/scripts/dbgen/main.go b/scripts/dbgen/main.go
index 8758048ccb68e..7396a5140d605 100644
--- a/scripts/dbgen/main.go
+++ b/scripts/dbgen/main.go
@@ -459,8 +459,7 @@ func orderAndStubDatabaseFunctions(filePath, receiver, structName string, stub f
 		return xerrors.Errorf("format package: %w", err)
 	}
 	data, err := imports.Process(filePath, buf.Bytes(), &imports.Options{
-		Comments:   true,
-		FormatOnly: true,
+		Comments: true,
 	})
 	if err != nil {
 		return xerrors.Errorf("process imports: %w", err)
diff --git a/scripts/release.sh b/scripts/release.sh
index 6f11705c305f4..8282863a62620 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -308,6 +308,21 @@ if [[ ${preview} =~ ^[Yy]$ ]]; then
 fi
 log
 
+# Prompt user to manually update the release calendar documentation
+log "IMPORTANT: Please manually update the release calendar documentation before proceeding."
+log "The release calendar is located at: https://coder.com/docs/install/releases#release-schedule"
+log "You can also run the update script: ./scripts/update-release-calendar.sh"
+log
+while [[ ! ${calendar_updated:-} =~ ^[YyNn]$ ]]; do
+	read -p "Have you updated the release calendar documentation? (y/n) " -n 1 -r calendar_updated
+	log
+done
+if ! [[ ${calendar_updated} =~ ^[Yy]$ ]]; then
+	log "Please update the release calendar documentation before proceeding with the release."
+	exit 0
+fi
+log
+
 while [[ ! ${create:-} =~ ^[YyNn]$ ]]; do
 	read -p "Create, build and publish release? (y/n) " -n 1 -r create
 	log
diff --git a/site/jest.setup.ts b/site/jest.setup.ts
index 31868b0d92d80..f90f5353b1c63 100644
--- a/site/jest.setup.ts
+++ b/site/jest.setup.ts
@@ -40,6 +40,12 @@ jest.mock("contexts/useProxyLatency", () => ({
 global.scrollTo = jest.fn();
 
 window.HTMLElement.prototype.scrollIntoView = jest.fn();
+// Polyfill pointer capture methods for JSDOM compatibility with Radix UI
+window.HTMLElement.prototype.hasPointerCapture = jest
+	.fn()
+	.mockReturnValue(false);
+window.HTMLElement.prototype.setPointerCapture = jest.fn();
+window.HTMLElement.prototype.releasePointerCapture = jest.fn();
 window.open = jest.fn();
 navigator.sendBeacon = jest.fn();
 
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 95152c4405489..4ab5403081a60 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -794,14 +794,18 @@ export const EntitlementsWarningHeader = "X-Coder-Entitlements-Warning";
 export type Experiment =
 	| "auto-fill-parameters"
 	| "example"
+	| "mcp-server-http"
 	| "notifications"
+	| "oauth2"
 	| "web-push"
 	| "workspace-usage";
 
 export const Experiments: Experiment[] = [
 	"auto-fill-parameters",
 	"example",
+	"mcp-server-http",
 	"notifications",
+	"oauth2",
 	"web-push",
 	"workspace-usage",
 ];
@@ -1459,6 +1463,75 @@ export interface OAuth2AuthorizationServerMetadata {
 	readonly token_endpoint_auth_methods_supported?: readonly string[];
 }
 
+// From codersdk/oauth2.go
+export interface OAuth2ClientConfiguration {
+	readonly client_id: string;
+	readonly client_id_issued_at: number;
+	readonly client_secret_expires_at?: number;
+	readonly redirect_uris?: readonly string[];
+	readonly client_name?: string;
+	readonly client_uri?: string;
+	readonly logo_uri?: string;
+	readonly tos_uri?: string;
+	readonly policy_uri?: string;
+	readonly jwks_uri?: string;
+	readonly jwks?: Record<string, string>;
+	readonly software_id?: string;
+	readonly software_version?: string;
+	readonly grant_types: readonly string[];
+	readonly response_types: readonly string[];
+	readonly token_endpoint_auth_method: string;
+	readonly scope?: string;
+	readonly contacts?: readonly string[];
+	readonly registration_access_token: string;
+	readonly registration_client_uri: string;
+}
+
+// From codersdk/oauth2.go
+export interface OAuth2ClientRegistrationRequest {
+	readonly redirect_uris?: readonly string[];
+	readonly client_name?: string;
+	readonly client_uri?: string;
+	readonly logo_uri?: string;
+	readonly tos_uri?: string;
+	readonly policy_uri?: string;
+	readonly jwks_uri?: string;
+	readonly jwks?: Record<string, string>;
+	readonly software_id?: string;
+	readonly software_version?: string;
+	readonly software_statement?: string;
+	readonly grant_types?: readonly string[];
+	readonly response_types?: readonly string[];
+	readonly token_endpoint_auth_method?: string;
+	readonly scope?: string;
+	readonly contacts?: readonly string[];
+}
+
+// From codersdk/oauth2.go
+export interface OAuth2ClientRegistrationResponse {
+	readonly client_id: string;
+	readonly client_secret?: string;
+	readonly client_id_issued_at: number;
+	readonly client_secret_expires_at?: number;
+	readonly redirect_uris?: readonly string[];
+	readonly client_name?: string;
+	readonly client_uri?: string;
+	readonly logo_uri?: string;
+	readonly tos_uri?: string;
+	readonly policy_uri?: string;
+	readonly jwks_uri?: string;
+	readonly jwks?: Record<string, string>;
+	readonly software_id?: string;
+	readonly software_version?: string;
+	readonly grant_types: readonly string[];
+	readonly response_types: readonly string[];
+	readonly token_endpoint_auth_method: string;
+	readonly scope?: string;
+	readonly contacts?: readonly string[];
+	readonly registration_access_token: string;
+	readonly registration_client_uri: string;
+}
+
 // From codersdk/deployment.go
 export interface OAuth2Config {
 	readonly github: OAuth2GithubConfig;
diff --git a/site/src/hooks/index.ts b/site/src/hooks/index.ts
index 901fee8a50ded..4453e36fa4bb4 100644
--- a/site/src/hooks/index.ts
+++ b/site/src/hooks/index.ts
@@ -3,3 +3,4 @@ export * from "./useClickable";
 export * from "./useClickableTableRow";
 export * from "./useClipboard";
 export * from "./usePagination";
+export * from "./useWithRetry";
diff --git a/site/src/hooks/useWithRetry.test.ts b/site/src/hooks/useWithRetry.test.ts
new file mode 100644
index 0000000000000..7ed7b4331f21e
--- /dev/null
+++ b/site/src/hooks/useWithRetry.test.ts
@@ -0,0 +1,329 @@
+import { act, renderHook } from "@testing-library/react";
+import { useWithRetry } from "./useWithRetry";
+
+// Mock timers
+jest.useFakeTimers();
+
+describe("useWithRetry", () => {
+	let mockFn: jest.Mock;
+
+	beforeEach(() => {
+		mockFn = jest.fn();
+		jest.clearAllTimers();
+	});
+
+	afterEach(() => {
+		jest.clearAllMocks();
+	});
+
+	it("should initialize with correct default state", () => {
+		const { result } = renderHook(() => useWithRetry(mockFn));
+
+		expect(result.current.isLoading).toBe(false);
+		expect(result.current.nextRetryAt).toBe(undefined);
+	});
+
+	it("should execute function successfully on first attempt", async () => {
+		mockFn.mockResolvedValue(undefined);
+
+		const { result } = renderHook(() => useWithRetry(mockFn));
+
+		await act(async () => {
+			await result.current.call();
+		});
+
+		expect(mockFn).toHaveBeenCalledTimes(1);
+		expect(result.current.isLoading).toBe(false);
+		expect(result.current.nextRetryAt).toBe(undefined);
+	});
+
+	it("should set isLoading to true during execution", async () => {
+		let resolvePromise: () => void;
+		const promise = new Promise<void>((resolve) => {
+			resolvePromise = resolve;
+		});
+		mockFn.mockReturnValue(promise);
+
+		const { result } = renderHook(() => useWithRetry(mockFn));
+
+		act(() => {
+			result.current.call();
+		});
+
+		expect(result.current.isLoading).toBe(true);
+
+		await act(async () => {
+			resolvePromise!();
+			await promise;
+		});
+
+		expect(result.current.isLoading).toBe(false);
+	});
+
+	it("should retry on failure with exponential backoff", async () => {
+		mockFn
+			.mockRejectedValueOnce(new Error("First failure"))
+			.mockRejectedValueOnce(new Error("Second failure"))
+			.mockResolvedValueOnce(undefined);
+
+		const { result } = renderHook(() => useWithRetry(mockFn));
+
+		// Start the call
+		await act(async () => {
+			await result.current.call();
+		});
+
+		expect(mockFn).toHaveBeenCalledTimes(1);
+		expect(result.current.isLoading).toBe(false);
+		expect(result.current.nextRetryAt).not.toBe(null);
+
+		// Fast-forward to first retry (1 second)
+		await act(async () => {
+			jest.advanceTimersByTime(1000);
+		});
+
+		expect(mockFn).toHaveBeenCalledTimes(2);
+		expect(result.current.isLoading).toBe(false);
+		expect(result.current.nextRetryAt).not.toBe(null);
+
+		// Fast-forward to second retry (2 seconds)
+		await act(async () => {
+			jest.advanceTimersByTime(2000);
+		});
+
+		expect(mockFn).toHaveBeenCalledTimes(3);
+		expect(result.current.isLoading).toBe(false);
+		expect(result.current.nextRetryAt).toBe(undefined);
+	});
+
+	it("should continue retrying without limit", async () => {
+		mockFn.mockRejectedValue(new Error("Always fails"));
+
+		const { result } = renderHook(() => useWithRetry(mockFn));
+
+		// Start the call
+		await act(async () => {
+			await result.current.call();
+		});
+
+		expect(mockFn).toHaveBeenCalledTimes(1);
+		expect(result.current.isLoading).toBe(false);
+		expect(result.current.nextRetryAt).not.toBe(null);
+
+		// Fast-forward through multiple retries to verify it continues
+		for (let i = 1; i < 15; i++) {
+			const delay = Math.min(1000 * 2 ** (i - 1), 600000); // exponential backoff with max delay
+			await act(async () => {
+				jest.advanceTimersByTime(delay);
+			});
+			expect(mockFn).toHaveBeenCalledTimes(i + 1);
+			expect(result.current.isLoading).toBe(false);
+			expect(result.current.nextRetryAt).not.toBe(null);
+		}
+
+		// Should still be retrying after 15 attempts
+		expect(result.current.nextRetryAt).not.toBe(null);
+	});
+
+	it("should respect max delay of 10 minutes", async () => {
+		mockFn.mockRejectedValue(new Error("Always fails"));
+
+		const { result } = renderHook(() => useWithRetry(mockFn));
+
+		// Start the call
+		await act(async () => {
+			await result.current.call();
+		});
+
+		expect(result.current.isLoading).toBe(false);
+
+		// Fast-forward through several retries to reach max delay
+		// After attempt 9, delay would be 1000 * 2^9 = 512000ms, which is less than 600000ms (10 min)
+		// After attempt 10, delay would be 1000 * 2^10 = 1024000ms, which should be capped at 600000ms
+
+		// Skip to attempt 9 (delay calculation: 1000 * 2^8 = 256000ms)
+		for (let i = 1; i < 9; i++) {
+			const delay = 1000 * 2 ** (i - 1);
+			await act(async () => {
+				jest.advanceTimersByTime(delay);
+			});
+		}
+
+		expect(mockFn).toHaveBeenCalledTimes(9);
+		expect(result.current.nextRetryAt).not.toBe(null);
+
+		// The 9th retry should use max delay (600000ms = 10 minutes)
+		await act(async () => {
+			jest.advanceTimersByTime(600000);
+		});
+
+		expect(mockFn).toHaveBeenCalledTimes(10);
+		expect(result.current.isLoading).toBe(false);
+		expect(result.current.nextRetryAt).not.toBe(null);
+
+		// Continue with more retries at max delay to verify it continues indefinitely
+		await act(async () => {
+			jest.advanceTimersByTime(600000);
+		});
+
+		expect(mockFn).toHaveBeenCalledTimes(11);
+		expect(result.current.nextRetryAt).not.toBe(null);
+	});
+
+	it("should cancel previous retry when call is invoked again", async () => {
+		mockFn
+			.mockRejectedValueOnce(new Error("First failure"))
+			.mockResolvedValueOnce(undefined);
+
+		const { result } = renderHook(() => useWithRetry(mockFn));
+
+		// Start the first call
+		await act(async () => {
+			await result.current.call();
+		});
+
+		expect(mockFn).toHaveBeenCalledTimes(1);
+		expect(result.current.isLoading).toBe(false);
+		expect(result.current.nextRetryAt).not.toBe(null);
+
+		// Call again before retry happens
+		await act(async () => {
+			await result.current.call();
+		});
+
+		expect(mockFn).toHaveBeenCalledTimes(2);
+		expect(result.current.isLoading).toBe(false);
+		expect(result.current.nextRetryAt).toBe(undefined);
+
+		// Advance time to ensure previous retry was cancelled
+		await act(async () => {
+			jest.advanceTimersByTime(5000);
+		});
+
+		expect(mockFn).toHaveBeenCalledTimes(2); // Should not have been called again
+	});
+
+	it("should set nextRetryAt when scheduling retry", async () => {
+		mockFn
+			.mockRejectedValueOnce(new Error("Failure"))
+			.mockResolvedValueOnce(undefined);
+
+		const { result } = renderHook(() => useWithRetry(mockFn));
+
+		// Start the call
+		await act(async () => {
+			await result.current.call();
+		});
+
+		const nextRetryAt = result.current.nextRetryAt;
+		expect(nextRetryAt).not.toBe(null);
+		expect(nextRetryAt).toBeInstanceOf(Date);
+
+		// nextRetryAt should be approximately 1 second in the future
+		const expectedTime = Date.now() + 1000;
+		const actualTime = nextRetryAt!.getTime();
+		expect(Math.abs(actualTime - expectedTime)).toBeLessThan(100); // Allow 100ms tolerance
+
+		// Advance past retry time
+		await act(async () => {
+			jest.advanceTimersByTime(1000);
+		});
+
+		expect(result.current.nextRetryAt).toBe(undefined);
+	});
+
+	it("should cleanup timer on unmount", async () => {
+		mockFn.mockRejectedValue(new Error("Failure"));
+
+		const { result, unmount } = renderHook(() => useWithRetry(mockFn));
+
+		// Start the call to create timer
+		await act(async () => {
+			await result.current.call();
+		});
+
+		expect(result.current.isLoading).toBe(false);
+		expect(result.current.nextRetryAt).not.toBe(null);
+
+		// Unmount should cleanup timer
+		unmount();
+
+		// Advance time to ensure timer was cleared
+		await act(async () => {
+			jest.advanceTimersByTime(5000);
+		});
+
+		// Function should not have been called again
+		expect(mockFn).toHaveBeenCalledTimes(1);
+	});
+
+	it("should prevent scheduling retries when function completes after unmount", async () => {
+		let rejectPromise: (error: Error) => void;
+		const promise = new Promise<void>((_, reject) => {
+			rejectPromise = reject;
+		});
+		mockFn.mockReturnValue(promise);
+
+		const { result, unmount } = renderHook(() => useWithRetry(mockFn));
+
+		// Start the call - this will make the function in-flight
+		act(() => {
+			result.current.call();
+		});
+
+		expect(result.current.isLoading).toBe(true);
+
+		// Unmount while function is still in-flight
+		unmount();
+
+		// Function completes with error after unmount
+		await act(async () => {
+			rejectPromise!(new Error("Failed after unmount"));
+			await promise.catch(() => {}); // Suppress unhandled rejection
+		});
+
+		// Advance time to ensure no retry timers were scheduled
+		await act(async () => {
+			jest.advanceTimersByTime(5000);
+		});
+
+		// Function should only have been called once (no retries after unmount)
+		expect(mockFn).toHaveBeenCalledTimes(1);
+	});
+
+	it("should do nothing when call() is invoked while function is already loading", async () => {
+		let resolvePromise: () => void;
+		const promise = new Promise<void>((resolve) => {
+			resolvePromise = resolve;
+		});
+		mockFn.mockReturnValue(promise);
+
+		const { result } = renderHook(() => useWithRetry(mockFn));
+
+		// Start the first call - this will set isLoading to true
+		act(() => {
+			result.current.call();
+		});
+
+		expect(result.current.isLoading).toBe(true);
+		expect(mockFn).toHaveBeenCalledTimes(1);
+
+		// Try to call again while loading - should do nothing
+		act(() => {
+			result.current.call();
+		});
+
+		// Function should not have been called again
+		expect(mockFn).toHaveBeenCalledTimes(1);
+		expect(result.current.isLoading).toBe(true);
+
+		// Complete the original promise
+		await act(async () => {
+			resolvePromise!();
+			await promise;
+		});
+
+		expect(result.current.isLoading).toBe(false);
+		expect(mockFn).toHaveBeenCalledTimes(1);
+	});
+});
diff --git a/site/src/hooks/useWithRetry.ts b/site/src/hooks/useWithRetry.ts
new file mode 100644
index 0000000000000..1310da221efc5
--- /dev/null
+++ b/site/src/hooks/useWithRetry.ts
@@ -0,0 +1,106 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { useEffectEvent } from "./hookPolyfills";
+
+const DELAY_MS = 1_000;
+const MAX_DELAY_MS = 600_000; // 10 minutes
+// Determines how much the delay between retry attempts increases after each
+// failure.
+const MULTIPLIER = 2;
+
+interface UseWithRetryResult {
+	call: () => void;
+	nextRetryAt: Date | undefined;
+	isLoading: boolean;
+}
+
+interface RetryState {
+	isLoading: boolean;
+	nextRetryAt: Date | undefined;
+}
+
+/**
+ * Hook that wraps a function with automatic retry functionality
+ * Provides a simple interface for executing functions with exponential backoff retry
+ */
+export function useWithRetry(fn: () => Promise<void>): UseWithRetryResult {
+	const [state, setState] = useState<RetryState>({
+		isLoading: false,
+		nextRetryAt: undefined,
+	});
+
+	const timeoutRef = useRef<number | null>(null);
+	const mountedRef = useRef(true);
+
+	const clearTimeout = useCallback(() => {
+		if (timeoutRef.current) {
+			window.clearTimeout(timeoutRef.current);
+			timeoutRef.current = null;
+		}
+	}, []);
+
+	const stableFn = useEffectEvent(fn);
+
+	const call = useCallback(() => {
+		if (state.isLoading) {
+			return;
+		}
+
+		clearTimeout();
+
+		const executeAttempt = async (attempt = 0): Promise<void> => {
+			if (!mountedRef.current) {
+				return;
+			}
+			setState({
+				isLoading: true,
+				nextRetryAt: undefined,
+			});
+
+			try {
+				await stableFn();
+				if (mountedRef.current) {
+					setState({ isLoading: false, nextRetryAt: undefined });
+				}
+			} catch (error) {
+				if (!mountedRef.current) {
+					return;
+				}
+				const delayMs = Math.min(
+					DELAY_MS * MULTIPLIER ** attempt,
+					MAX_DELAY_MS,
+				);
+
+				setState({
+					isLoading: false,
+					nextRetryAt: new Date(Date.now() + delayMs),
+				});
+
+				timeoutRef.current = window.setTimeout(() => {
+					if (!mountedRef.current) {
+						return;
+					}
+					setState({
+						isLoading: false,
+						nextRetryAt: undefined,
+					});
+					executeAttempt(attempt + 1);
+				}, delayMs);
+			}
+		};
+
+		executeAttempt();
+	}, [state.isLoading, stableFn, clearTimeout]);
+
+	useEffect(() => {
+		return () => {
+			mountedRef.current = false;
+			clearTimeout();
+		};
+	}, [clearTimeout]);
+
+	return {
+		call,
+		nextRetryAt: state.nextRetryAt,
+		isLoading: state.isLoading,
+	};
+}
diff --git a/site/src/modules/workspaces/DynamicParameter/DynamicParameter.test.tsx b/site/src/modules/workspaces/DynamicParameter/DynamicParameter.test.tsx
new file mode 100644
index 0000000000000..43e75af1d2f0e
--- /dev/null
+++ b/site/src/modules/workspaces/DynamicParameter/DynamicParameter.test.tsx
@@ -0,0 +1,1014 @@
+import { act, fireEvent, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type { PreviewParameter } from "api/typesGenerated";
+import { render } from "testHelpers/renderHelpers";
+import { DynamicParameter } from "./DynamicParameter";
+
+const createMockParameter = (
+	overrides: Partial<PreviewParameter> = {},
+): PreviewParameter => ({
+	name: "test_param",
+	display_name: "Test Parameter",
+	description: "A test parameter",
+	type: "string",
+	mutable: true,
+	default_value: { value: "", valid: true },
+	icon: "",
+	options: [],
+	validations: [],
+	styling: {
+		placeholder: "",
+		disabled: false,
+		label: "",
+	},
+	diagnostics: [],
+	value: { value: "", valid: true },
+	required: false,
+	order: 1,
+	form_type: "input",
+	ephemeral: false,
+	...overrides,
+});
+
+const mockStringParameter = createMockParameter({
+	name: "string_param",
+	display_name: "String Parameter",
+	description: "A string input parameter",
+	type: "string",
+	form_type: "input",
+	default_value: { value: "default_value", valid: true },
+});
+
+const mockTextareaParameter = createMockParameter({
+	name: "textarea_param",
+	display_name: "Textarea Parameter",
+	description: "A textarea input parameter",
+	type: "string",
+	form_type: "textarea",
+	default_value: { value: "default\nmultiline\nvalue", valid: true },
+});
+
+const mockTagsParameter = createMockParameter({
+	name: "tags_param",
+	display_name: "Tags Parameter",
+	description: "A tags parameter",
+	type: "list(string)",
+	form_type: "tag-select",
+	default_value: { value: '["tag1", "tag2"]', valid: true },
+});
+
+const mockRequiredParameter = createMockParameter({
+	name: "required_param",
+	display_name: "Required Parameter",
+	description: "A required parameter",
+	type: "string",
+	form_type: "input",
+	required: true,
+});
+
+describe("DynamicParameter", () => {
+	const mockOnChange = jest.fn();
+
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	describe("Input Parameter", () => {
+		const mockParameterWithIcon = createMockParameter({
+			name: "icon_param",
+			display_name: "Parameter with Icon",
+			description: "A parameter with an icon",
+			type: "string",
+			form_type: "input",
+			icon: "/test-icon.png",
+		});
+
+		it("renders string input parameter correctly", () => {
+			render(
+				<DynamicParameter
+					parameter={mockStringParameter}
+					value="test_value"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("String Parameter")).toBeInTheDocument();
+			expect(screen.getByText("A string input parameter")).toBeInTheDocument();
+			expect(screen.getByRole("textbox")).toHaveValue("test_value");
+		});
+
+		it("calls onChange when input value changes", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockStringParameter}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const input = screen.getByRole("textbox");
+
+			await waitFor(async () => {
+				await userEvent.type(input, "new_value");
+			});
+
+			await waitFor(() => {
+				expect(mockOnChange).toHaveBeenCalledWith("new_value");
+			});
+		});
+
+		it("shows required indicator for required parameters", () => {
+			render(
+				<DynamicParameter
+					parameter={mockRequiredParameter}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("*")).toBeInTheDocument();
+		});
+
+		it("disables input when disabled prop is true", () => {
+			render(
+				<DynamicParameter
+					parameter={mockStringParameter}
+					value=""
+					onChange={mockOnChange}
+					disabled={true}
+				/>,
+			);
+
+			expect(screen.getByRole("textbox")).toBeDisabled();
+		});
+
+		it("displays parameter icon when provided", () => {
+			render(
+				<DynamicParameter
+					parameter={mockParameterWithIcon}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const icon = screen.getByRole("img");
+			expect(icon).toHaveAttribute("src", "/test-icon.png");
+		});
+	});
+
+	describe("Textarea Parameter", () => {
+		it("renders textarea parameter correctly", () => {
+			const testValue = "multiline\ntext\nvalue";
+			render(
+				<DynamicParameter
+					parameter={mockTextareaParameter}
+					value={testValue}
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Textarea Parameter")).toBeInTheDocument();
+			expect(screen.getByRole("textbox")).toHaveValue(testValue);
+		});
+
+		it("handles textarea value changes", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockTextareaParameter}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const textarea = screen.getByRole("textbox");
+			await waitFor(async () => {
+				await userEvent.type(textarea, "line1{enter}line2{enter}line3");
+			});
+
+			await waitFor(() => {
+				expect(mockOnChange).toHaveBeenCalledWith("line1\nline2\nline3");
+			});
+		});
+	});
+
+	describe("Select Parameter", () => {
+		const mockSelectParameter = createMockParameter({
+			name: "select_param",
+			display_name: "Select Parameter",
+			description: "A select parameter with options",
+			type: "string",
+			form_type: "dropdown",
+			default_value: { value: "option1", valid: true },
+			options: [
+				{
+					name: "Option 1",
+					description: "First option",
+					value: { value: "option1", valid: true },
+					icon: "",
+				},
+				{
+					name: "Option 2",
+					description: "Second option",
+					value: { value: "option2", valid: true },
+					icon: "/icon2.png",
+				},
+				{
+					name: "Option 3",
+					description: "Third option",
+					value: { value: "option3", valid: true },
+					icon: "",
+				},
+			],
+		});
+
+		it("renders select parameter with options", () => {
+			render(
+				<DynamicParameter
+					parameter={mockSelectParameter}
+					value="option1"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Select Parameter")).toBeInTheDocument();
+			expect(screen.getByRole("combobox")).toBeInTheDocument();
+		});
+
+		it("displays all options when opened", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockSelectParameter}
+					value="option1"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const select = screen.getByRole("combobox");
+			await waitFor(async () => {
+				await userEvent.click(select);
+			});
+
+			// Option 1 exists in the trigger and the dropdown
+			expect(screen.getAllByText("Option 1")).toHaveLength(2);
+			expect(screen.getByText("Option 2")).toBeInTheDocument();
+			expect(screen.getByText("Option 3")).toBeInTheDocument();
+		});
+
+		it("calls onChange when option is selected", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockSelectParameter}
+					value="option1"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const select = screen.getByRole("combobox");
+			await waitFor(async () => {
+				await userEvent.click(select);
+			});
+
+			const option2 = screen.getByText("Option 2");
+			await waitFor(async () => {
+				await userEvent.click(option2);
+			});
+
+			expect(mockOnChange).toHaveBeenCalledWith("option2");
+		});
+
+		it("displays option icons when provided", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockSelectParameter}
+					value="option1"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const select = screen.getByRole("combobox");
+			await waitFor(async () => {
+				await userEvent.click(select);
+			});
+
+			const icons = screen.getAllByRole("img");
+			expect(
+				icons.some((icon) => icon.getAttribute("src") === "/icon2.png"),
+			).toBe(true);
+		});
+	});
+
+	describe("Radio Parameter", () => {
+		const mockRadioParameter = createMockParameter({
+			name: "radio_param",
+			display_name: "Radio Parameter",
+			description: "A radio button parameter",
+			type: "string",
+			form_type: "radio",
+			default_value: { value: "radio1", valid: true },
+			options: [
+				{
+					name: "Radio 1",
+					description: "First radio option",
+					value: { value: "radio1", valid: true },
+					icon: "",
+				},
+				{
+					name: "Radio 2",
+					description: "Second radio option",
+					value: { value: "radio2", valid: true },
+					icon: "",
+				},
+			],
+		});
+
+		it("renders radio parameter with options", () => {
+			render(
+				<DynamicParameter
+					parameter={mockRadioParameter}
+					value="radio1"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Radio Parameter")).toBeInTheDocument();
+			expect(screen.getByRole("radiogroup")).toBeInTheDocument();
+			expect(screen.getByRole("radio", { name: /radio 1/i })).toBeChecked();
+			expect(screen.getByRole("radio", { name: /radio 2/i })).not.toBeChecked();
+		});
+
+		it("calls onChange when radio option is selected", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockRadioParameter}
+					value="radio1"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const radio2 = screen.getByRole("radio", { name: /radio 2/i });
+			await waitFor(async () => {
+				await userEvent.click(radio2);
+			});
+
+			expect(mockOnChange).toHaveBeenCalledWith("radio2");
+		});
+	});
+
+	describe("Checkbox Parameter", () => {
+		const mockCheckboxParameter = createMockParameter({
+			name: "checkbox_param",
+			display_name: "Checkbox Parameter",
+			description: "A checkbox parameter",
+			type: "bool",
+			form_type: "checkbox",
+			default_value: { value: "true", valid: true },
+		});
+
+		it("Renders checkbox parameter correctly and handles unchecked to checked transition", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockCheckboxParameter}
+					value="false"
+					onChange={mockOnChange}
+				/>,
+			);
+			expect(screen.getByText("Checkbox Parameter")).toBeInTheDocument();
+
+			const checkbox = screen.getByRole("checkbox");
+			expect(checkbox).not.toBeChecked();
+
+			await waitFor(async () => {
+				await userEvent.click(checkbox);
+			});
+
+			expect(mockOnChange).toHaveBeenCalledWith("true");
+		});
+	});
+
+	describe("Switch Parameter", () => {
+		const mockSwitchParameter = createMockParameter({
+			name: "switch_param",
+			display_name: "Switch Parameter",
+			description: "A switch parameter",
+			type: "bool",
+			form_type: "switch",
+			default_value: { value: "false", valid: true },
+		});
+
+		it("renders switch parameter correctly", () => {
+			render(
+				<DynamicParameter
+					parameter={mockSwitchParameter}
+					value="false"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Switch Parameter")).toBeInTheDocument();
+			expect(screen.getByRole("switch")).not.toBeChecked();
+		});
+
+		it("handles switch state changes", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockSwitchParameter}
+					value="false"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const switchElement = screen.getByRole("switch");
+			await waitFor(async () => {
+				await userEvent.click(switchElement);
+			});
+
+			expect(mockOnChange).toHaveBeenCalledWith("true");
+		});
+	});
+
+	describe("Slider Parameter", () => {
+		const mockSliderParameter = createMockParameter({
+			name: "slider_param",
+			display_name: "Slider Parameter",
+			description: "A slider parameter",
+			type: "number",
+			form_type: "slider",
+			default_value: { value: "50", valid: true },
+			validations: [
+				{
+					validation_min: 0,
+					validation_max: 100,
+					validation_error: "Value must be between 0 and 100",
+					validation_regex: null,
+					validation_monotonic: null,
+				},
+			],
+		});
+
+		it("renders slider parameter correctly", () => {
+			render(
+				<DynamicParameter
+					parameter={mockSliderParameter}
+					value="50"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Slider Parameter")).toBeInTheDocument();
+			const slider = screen.getByRole("slider");
+			expect(slider).toHaveAttribute("aria-valuenow", "50");
+		});
+
+		it("respects min/max constraints from validation_condition", () => {
+			render(
+				<DynamicParameter
+					parameter={mockSliderParameter}
+					value="50"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const slider = screen.getByRole("slider");
+			expect(slider).toHaveAttribute("aria-valuemin", "0");
+			expect(slider).toHaveAttribute("aria-valuemax", "100");
+		});
+	});
+
+	describe("Tags Parameter", () => {
+		it("renders tags parameter correctly", () => {
+			render(
+				<DynamicParameter
+					parameter={mockTagsParameter}
+					value='["tag1", "tag2", "tag3"]'
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Tags Parameter")).toBeInTheDocument();
+			expect(screen.getByRole("textbox")).toBeInTheDocument();
+		});
+
+		it("handles tag additions", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockTagsParameter}
+					value='["tag1"]'
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const input = screen.getByRole("textbox");
+			await waitFor(async () => {
+				await userEvent.type(input, "newtag,");
+			});
+
+			await waitFor(() => {
+				expect(mockOnChange).toHaveBeenCalledWith('["tag1","newtag"]');
+			});
+		});
+
+		it("handles tag removals", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockTagsParameter}
+					value='["tag1", "tag2"]'
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const deleteButtons = screen.getAllByTestId("CancelIcon");
+			await waitFor(async () => {
+				await userEvent.click(deleteButtons[0]);
+			});
+
+			expect(mockOnChange).toHaveBeenCalledWith('["tag2"]');
+		});
+	});
+
+	describe("Multi-Select Parameter", () => {
+		const mockMultiSelectParameter = createMockParameter({
+			name: "multiselect_param",
+			display_name: "Multi-Select Parameter",
+			description: "A multi-select parameter",
+			type: "list(string)",
+			form_type: "multi-select",
+			default_value: { value: '["option1", "option3"]', valid: true },
+			options: [
+				{
+					name: "Option 1",
+					description: "First option",
+					value: { value: "option1", valid: true },
+					icon: "",
+				},
+				{
+					name: "Option 2",
+					description: "Second option",
+					value: { value: "option2", valid: true },
+					icon: "",
+				},
+				{
+					name: "Option 3",
+					description: "Third option",
+					value: { value: "option3", valid: true },
+					icon: "",
+				},
+				{
+					name: "Option 4",
+					description: "Fourth option",
+					value: { value: "option4", valid: true },
+					icon: "",
+				},
+			],
+		});
+
+		it("renders multi-select parameter correctly", () => {
+			render(
+				<DynamicParameter
+					parameter={mockMultiSelectParameter}
+					value='["option1", "option3"]'
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Multi-Select Parameter")).toBeInTheDocument();
+			expect(screen.getByRole("combobox")).toBeInTheDocument();
+		});
+
+		it("displays selected options", () => {
+			render(
+				<DynamicParameter
+					parameter={mockMultiSelectParameter}
+					value='["option1", "option3"]'
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Option 1")).toBeInTheDocument();
+			expect(screen.getByText("Option 3")).toBeInTheDocument();
+		});
+
+		it("handles option selection", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockMultiSelectParameter}
+					value='["option1"]'
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const combobox = screen.getByRole("combobox");
+			await waitFor(async () => {
+				await userEvent.click(combobox);
+			});
+
+			const option2 = screen.getByText("Option 2");
+			await waitFor(async () => {
+				await userEvent.click(option2);
+			});
+
+			expect(mockOnChange).toHaveBeenCalledWith('["option1","option2"]');
+		});
+
+		it("handles option deselection", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockMultiSelectParameter}
+					value='["option1", "option2"]'
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const removeButtons = screen.getAllByTestId("clear-option-button");
+			await waitFor(async () => {
+				await userEvent.click(removeButtons[0]);
+			});
+
+			expect(mockOnChange).toHaveBeenCalledWith('["option2"]');
+		});
+	});
+
+	describe("Error Parameter", () => {
+		const mockErrorParameter = createMockParameter({
+			name: "error_param",
+			display_name: "Error Parameter",
+			description: "A parameter with validation error",
+			type: "string",
+			form_type: "error",
+			diagnostics: [
+				{
+					severity: "error",
+					summary: "Validation Error",
+					detail: "This parameter has a validation error",
+					extra: {
+						code: "validation_error",
+					},
+				},
+			],
+		});
+
+		it("renders error parameter with validation message", () => {
+			render(
+				<DynamicParameter
+					parameter={mockErrorParameter}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Error Parameter")).toBeInTheDocument();
+			expect(
+				screen.getByText("This parameter has a validation error"),
+			).toBeInTheDocument();
+		});
+	});
+
+	describe("Parameter Badges", () => {
+		const mockEphemeralParameter = createMockParameter({
+			name: "ephemeral_param",
+			display_name: "Ephemeral Parameter",
+			description: "An ephemeral parameter",
+			type: "string",
+			form_type: "input",
+			ephemeral: true,
+		});
+
+		const mockImmutableParameter = createMockParameter({
+			name: "immutable_param",
+			display_name: "Immutable Parameter",
+			description: "An immutable parameter",
+			type: "string",
+			form_type: "input",
+			mutable: false,
+			default_value: { value: "immutable_value", valid: true },
+		});
+
+		it("shows immutable indicator for immutable parameters", () => {
+			render(
+				<DynamicParameter
+					parameter={mockImmutableParameter}
+					value="immutable_value"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Immutable")).toBeInTheDocument();
+		});
+
+		it("shows autofill indicator when autofill is true", () => {
+			render(
+				<DynamicParameter
+					parameter={mockStringParameter}
+					value="autofilled_value"
+					onChange={mockOnChange}
+					autofill={true}
+				/>,
+			);
+
+			expect(screen.getByText(/URL Autofill/i)).toBeInTheDocument();
+		});
+
+		it("shows ephemeral indicator for ephemeral parameters", () => {
+			render(
+				<DynamicParameter
+					parameter={mockEphemeralParameter}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Ephemeral")).toBeInTheDocument();
+		});
+
+		it("shows preset indicator when isPreset is true", () => {
+			render(
+				<DynamicParameter
+					parameter={mockStringParameter}
+					value="preset_value"
+					onChange={mockOnChange}
+					isPreset={true}
+				/>,
+			);
+
+			expect(screen.getByText(/preset/i)).toBeInTheDocument();
+		});
+	});
+
+	describe("Accessibility", () => {
+		it("associates labels with form controls", () => {
+			render(
+				<DynamicParameter
+					parameter={mockStringParameter}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const input = screen.getByRole("textbox");
+
+			expect(input).toHaveAccessibleName("String Parameter");
+		});
+
+		it("marks required fields appropriately", () => {
+			render(
+				<DynamicParameter
+					parameter={mockRequiredParameter}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const input = screen.getByRole("textbox");
+			expect(input).toBeRequired();
+		});
+	});
+
+	describe("Debounced Input", () => {
+		it("debounces input changes for text inputs", async () => {
+			jest.useFakeTimers();
+
+			render(
+				<DynamicParameter
+					parameter={mockStringParameter}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const input = screen.getByRole("textbox");
+			fireEvent.change(input, { target: { value: "abc" } });
+
+			expect(mockOnChange).not.toHaveBeenCalled();
+
+			act(() => {
+				jest.runAllTimers();
+			});
+
+			expect(mockOnChange).toHaveBeenCalledWith("abc");
+
+			jest.useRealTimers();
+		});
+
+		it("debounces textarea changes", async () => {
+			jest.useFakeTimers();
+
+			render(
+				<DynamicParameter
+					parameter={mockTextareaParameter}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const textarea = screen.getByRole("textbox");
+			fireEvent.change(textarea, { target: { value: "line1\nline2" } });
+
+			expect(mockOnChange).not.toHaveBeenCalled();
+
+			act(() => {
+				jest.runAllTimers();
+			});
+
+			expect(mockOnChange).toHaveBeenCalledWith("line1\nline2");
+
+			jest.useRealTimers();
+		});
+	});
+
+	describe("Edge Cases", () => {
+		it("handles empty parameter options gracefully", () => {
+			const paramWithEmptyOptions = createMockParameter({
+				form_type: "dropdown",
+				options: [],
+			});
+
+			render(
+				<DynamicParameter
+					parameter={paramWithEmptyOptions}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByRole("combobox")).toBeInTheDocument();
+		});
+
+		it("handles null/undefined values", () => {
+			render(
+				<DynamicParameter
+					parameter={mockStringParameter}
+					value={undefined}
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByRole("textbox")).toHaveValue("");
+		});
+
+		it("handles invalid JSON in list parameters", () => {
+			render(
+				<DynamicParameter
+					parameter={mockTagsParameter}
+					value="invalid json"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("Tags Parameter")).toBeInTheDocument();
+		});
+
+		it("handles parameters with very long descriptions", () => {
+			const longDescriptionParam = createMockParameter({
+				description: "A".repeat(1000),
+			});
+
+			render(
+				<DynamicParameter
+					parameter={longDescriptionParam}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("A".repeat(1000))).toBeInTheDocument();
+		});
+
+		it("handles parameters with special characters in names", () => {
+			const specialCharParam = createMockParameter({
+				name: "param-with_special.chars",
+				display_name: "Param with Special Characters!@#$%",
+			});
+
+			render(
+				<DynamicParameter
+					parameter={specialCharParam}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(
+				screen.getByText("Param with Special Characters!@#$%"),
+			).toBeInTheDocument();
+		});
+	});
+
+	describe("Number Input Parameter", () => {
+		const mockNumberInputParameter = createMockParameter({
+			name: "number_input_param",
+			display_name: "Number Input Parameter",
+			description: "A numeric input parameter with min/max validations",
+			type: "number",
+			form_type: "input",
+			default_value: { value: "5", valid: true },
+			validations: [
+				{
+					validation_min: 1,
+					validation_max: 10,
+					validation_error: "Value must be between 1 and 10",
+					validation_regex: null,
+					validation_monotonic: null,
+				},
+			],
+		});
+
+		it("renders number input with correct min/max attributes", () => {
+			render(
+				<DynamicParameter
+					parameter={mockNumberInputParameter}
+					value="5"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const input = screen.getByRole("spinbutton");
+			expect(input).toHaveAttribute("min", "1");
+			expect(input).toHaveAttribute("max", "10");
+		});
+
+		it("calls onChange when numeric value changes (debounced)", () => {
+			jest.useFakeTimers();
+			render(
+				<DynamicParameter
+					parameter={mockNumberInputParameter}
+					value="5"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const input = screen.getByRole("spinbutton");
+			fireEvent.change(input, { target: { value: "7" } });
+
+			act(() => {
+				jest.runAllTimers();
+			});
+
+			expect(mockOnChange).toHaveBeenCalledWith("7");
+			jest.useRealTimers();
+		});
+	});
+
+	describe("Masked Input Parameter", () => {
+		const mockMaskedInputParameter = createMockParameter({
+			name: "masked_input_param",
+			display_name: "Masked Input Parameter",
+			type: "string",
+			form_type: "input",
+			styling: {
+				placeholder: "********",
+				disabled: false,
+				label: "",
+				mask_input: true,
+			},
+		});
+
+		it("renders a password field by default and toggles visibility on mouse events", async () => {
+			render(
+				<DynamicParameter
+					parameter={mockMaskedInputParameter}
+					value="secret123"
+					onChange={mockOnChange}
+				/>,
+			);
+
+			const input = screen.getByLabelText("Masked Input Parameter");
+			expect(input).toHaveAttribute("type", "password");
+
+			const toggleButton = screen.getByRole("button");
+			fireEvent.mouseDown(toggleButton);
+			expect(input).toHaveAttribute("type", "text");
+
+			fireEvent.mouseUp(toggleButton);
+			expect(input).toHaveAttribute("type", "password");
+		});
+	});
+
+	describe("Parameter Diagnostics", () => {
+		const mockWarningParameter = createMockParameter({
+			name: "warning_param",
+			display_name: "Warning Parameter",
+			description: "Parameter with a warning diagnostic",
+			form_type: "input",
+			diagnostics: [
+				{
+					severity: "warning",
+					summary: "This is a warning",
+					detail: "Something might be wrong",
+					extra: { code: "warning" },
+				},
+			],
+		});
+
+		it("renders warning diagnostics for non-error parameters", () => {
+			render(
+				<DynamicParameter
+					parameter={mockWarningParameter}
+					value=""
+					onChange={mockOnChange}
+				/>,
+			);
+
+			expect(screen.getByText("This is a warning")).toBeInTheDocument();
+			expect(screen.getByText("Something might be wrong")).toBeInTheDocument();
+		});
+	});
+});