Client ID Metadata Document

Generate, validate, and temporarily host CIMD JSON (IETF draft) for MCP/AI agents — client_id as HTTPS URL, security checks, authorization URL builder.

Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Generate and validate Client ID Metadata Documents (IETF draft), then host them temporarily on stbox (5–30 min) so an AS can fetch client_id — same idea as SAML SP metadata URLs.

🔒 100% Client-Side Cryptography (Web Crypto API)

Configuration

client_id (HTTPS URL of this document)

client_name

client_uri

logo_uri

scope

redirect_uris (one per line)

grant_types

authorization_coderefresh_tokenurn:ietf:params:oauth:grant-type:device_codeurn:ietf:params:oauth:grant-type:token-exchange

response_types

code

token_endpoint_auth_method

Symmetric secrets (client_secret_*) are forbidden.

jwks_uri

Temporary host (for AS / MCP testing)

Publishes JSON at an HTTPS URL and rewrites client_id to match (CIMD requirement). TTL 5–30 minutes. No private keys.

TTL: 10 minutes

Live generator checks

passclient_id HTTPS URL
https://app.example.com/oauth/client-metadata.json
passOrigin matching
client_id and client_uri share origin https://app.example.com.
passtoken_endpoint_auth_method
none
passredirect_uris
2 URI(s) look structurally valid.

Host this JSON at your client_id URL

{
  "client_id": "https://app.example.com/oauth/client-metadata.json",
  "client_name": "Example MCP Client",
  "client_uri": "https://app.example.com",
  "logo_uri": "https://app.example.com/logo.png",
  "redirect_uris": [
    "http://127.0.0.1:3000/callback",
    "https://app.example.com/callback"
  ],
  "grant_types": [
    "authorization_code"
  ],
  "response_types": [
    "code"
  ],
  "token_endpoint_auth_method": "none",
  "scope": "openid profile"
}

What is a Client ID Metadata Document?

CIMD (IETF draft-ietf-oauth-client-id-metadata-document) uses an HTTPS URL as the OAuth client_id. That URL hosts a JSON document with standard client metadata so authorization servers can fetch identity on demand — no prior DCR required.

It is especially useful for MCP and AI agent clients. Symmetric client secrets are forbidden; use none (public + PKCE) or private_key_jwt with a jwks_uri.

How to use this tool

Fill metadata fields, optionally Host CIMD URL (5–30 min TTL; client_id rewritten to the hosted URL), then validate or build an authorize URL.
Paste or fetch a document into the validator to check HTTPS client_id, origin hints, forbidden auth methods, and redirect URIs.
Build an authorization URL that passes the CIMD URL as client_id.

Frequently asked questions

Why can’t I use client_secret_basic with CIMD?

The draft forbids shared-secret authentication methods. Secrets cannot be published in a fetchable metadata document. Use none or asymmetric methods such as private_key_jwt.

How does temporary hosting work?

Like SAML SP metadata hosting: stbox keeps the JSON in memory for 5–30 minutes at an HTTPS URL with CORS enabled so authorization servers can fetch it. Private keys are rejected.