Dynamic Client Registration (RFC 7591) for clients that do not use Client ID Metadata Documents. Public clients only; no authentication. Put a rate limit in front of it.
A client that sends no grant_types is registered for both the
authorization code and the refresh token grants, and the response says
so.