OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization) vs OAuth Client ID Metadata Document (CIMD)
The map lists them as complementary: sites and agents commonly implement both.
| OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization) | OAuth Client ID Metadata Document CIMD | |
|---|---|---|
| Lifecycle step | 3 Permit: What may the agent do here? | 3 Permit: What may the agent do here? |
| Answers | How does an agent (or an MCP client acting for it) discover which authorization server protects a resource, and what that authorization server's endpoints and capabilities are, before requesting access? | How can an authorization server accept an OAuth client, such as an MCP client, that it has never seen before, without pre-registration or Dynamic Client Registration? |
| Governed by | IETF OAuth Working Group; both are Internet Standards Track RFCs with IETF/IESG consensus | IETF OAuth Working Group (WG Document) |
| Status (issuer's words) | Internet Standard (RFC 8414, published June 2018) and Internet Standard (RFC 9728, published 2025); both are products of IETF consensus, not works in progress | Active Internet-Draft, WG Document of the IETF oauth WG; -02 dated 2026-07-06, expires 2027-01-07; the draft header says Standards Track |
| Version | RFC 8414 (2018-06) and RFC 9728 (2025) (2025) | draft-ietf-oauth-client-id-metadata-document-02 (2026-07-06) |
| Form / transport | well-known file | document format |
| Found at | /.well-known/oauth-protected-resource | /.well-known/oauth-authorization-server |
| Implementation | multi-implementation | multi-implementation |
| Evidence | 2 verified, 1 reported | 2 verified |
| Primary use case | Let agents discover my API or service | Delegate a user's authority to an agent |
| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |
| Specification | https://www.rfc-editor.org/rfc/rfc9728.html | https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/ |
When to use which
- Choose OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization) when your question is “How does an agent (or an MCP client acting for it) discover which authorization server protects a resource, and what that authorization server's endpoints and capabilities are, before requesting access?” and you accept its maturity: status "Internet Standard (RFC 8414, published June 2018) and Internet Standard (RFC 9728, published 2025); both are products of IETF consensus, not works in progress", implementation multi-implementation.
- Choose OAuth Client ID Metadata Document when your question is “How can an authorization server accept an OAuth client, such as an MCP client, that it has never seen before, without pre-registration or Dynamic Client Registration?” and you accept its maturity: status "Active Internet-Draft, WG Document of the IETF oauth WG; -02 dated 2026-07-06, expires 2027-01-07; the draft header says Standards Track", implementation multi-implementation.
Read the full articles
- OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization): How does an agent (or an MCP client acting for it) discover which authorization server protects a resource, and what that authorization server's endpoints and capabilities are, before requesting access?
- OAuth Client ID Metadata Document: How can an authorization server accept an OAuth client, such as an MCP client, that it has never seen before, without pre-registration or Dynamic Client Registration?