diff --git a/paskia/fastapi/ws.py b/paskia/fastapi/ws.py
index e607fbc..4a9770a 100644
--- a/paskia/fastapi/ws.py
+++ b/paskia/fastapi/ws.py
@@ -125,7 +125,17 @@ async def websocket_authenticate(
             await ws.send_json({"status": 400, "detail": "Unknown client_id"})
             return
 
-        if redirect_uri not in oidc_client.redirect_uris:
+        # Redirect URI autodiscovery: if no URIs are defined, store the first one
+        if not oidc_client.redirect_uris:
+            # Basic validation: must be an HTTP(S) URL
+            if not redirect_uri.startswith(("http://", "https://")):
+                await ws.send_json({"status": 400, "detail": "Invalid redirect_uri"})
+                return
+            # Store as the only allowed redirect URI
+            db.update_oid_client(client_uuid, redirect_uris=[redirect_uri])
+            # Reload client to get updated redirect_uris
+            oidc_client = db.data().oid_clients.get(client_uuid)
+        elif redirect_uri not in oidc_client.redirect_uris:
             await ws.send_json({"status": 400, "detail": "Invalid redirect_uri"})
             return