OAuth Client ID Metadata Document CIMD
OAuth Client ID Metadata Document (CIMD) is an agentic-web standard (document format) at step 3, Permit, governed by IETF OAuth Working Group (WG Document); its own status is "Active Internet-Draft, WG Document of the IETF oauth WG; -02 dated 2026-07-06, expires 2027-01-07; the draft header says Standards Track" (working group). It answers: How can an authorization server accept an OAuth client, such as an MCP client, that it has never seen before, without pre-registration or Dynamic Client Registration? Adoption is unmeasured, last verified 2026-10-20.
Permit A Client ID Metadata Document lets an OAuth client use an HTTPS URL as its client_id and publish its metadata (name, redirect URIs, keys) at that URL [1]. An authorization server that has never seen the client fetches the URL and learns what it needs. That removes the need to register in advance or to use Dynamic Client Registration. Servers say they support it with client_id_metadata_document_supported in their RFC 8414 metadata [2].
Overview
It matters for agents mainly through MCP. The stable MCP revision of 2026-07-28 says clients and authorization servers SHOULD support CIMD, and it deprecates Dynamic Client Registration [2]. That spec still cites the -00 revision of the draft.
The draft is an IETF OAuth working group document, by Aaron Parecki and Emelia Smith; revision -02 is dated 2026-07-06 [1]. This site has not counted how many authorization servers advertise support.
Discovery and probe
the client_id is an HTTPS URL that serves the client's metadata JSON; authorization servers advertise support with client_id_metadata_document_supported in their RFC 8414 metadata · /.well-known/oauth-authorization-server
GET {origin}/.well-known/oauth-authorization-server
parse: RFC 8414 authorization server metadata JSON; check for client_id_metadata_document_supported: true
on absent: The authorization server does not advertise CIMD support; clients must pre-register or fall back to Dynamic Client Registration.
{
"path": "/.well-known/oauth-authorization-server",
"expect": {
"json_keys": [
"client_id_metadata_document_supported"
]
},
"note": "RFC 8414 metadata advertises CIMD support with client_id_metadata_document_supported."
}
History
- 2026-10-20 — added from gap scout 2026-10-20; verified against the datatracker record of draft-ietf-oauth-client-id-metadata-document and the MCP 2026-07-28 client-registration page
Instances
No instances recorded yet.
See also
References
- Datatracker lists draft-ietf-oauth-client-id-metadata-document-02 as an Active Internet-Draft in WG state 'WG Document' of the oauth WG, by Aaron Parecki (Okta) and Emelia Smith, dated 2026-07-06 and expiring 2027-01-07, replacing draft-parecki-oauth-client-id-metadata-document. — https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/ (2026-07-06) VERIFIED
- The stable MCP specification revision 2026-07-28 says MCP clients and authorization servers SHOULD support OAuth Client ID Metadata Documents, uses the client_id_metadata_document_supported metadata field, and says Dynamic Client Registration is deprecated. — https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration (2026-07-28) VERIFIED