OAuth Client ID Metadata Document Support in Authorization Servers

Security Recommendation

Authorization servers SHOULD support OAuth Client ID Metadata Documents. This mechanism allows clients (including MCP clients) to present their identity and configuration without requiring pre-registration, by hosting a metadata document at their client_id URL.

How It Works

1. Client presents a client_id that is an HTTPS URL (e.g., https://mcp-client.example.com/client-metadata)
2. Authorization server fetches the metadata document from that URL
3. Authorization server validates the client's configuration from the document
4. Authorization server uses the metadata for the OAuth flow

Validation Rules

When fetching and processing client metadata documents, the authorization server MUST: