IETF · 6 July 2026
draft-ietf-oauth-client-id-metadata-document-02
A. Parecki, E. Smith
This is the OAuth WG's answer to 'my agent did not pre-register'. AAuth goes further and drops the AS-issued client_id altogether; CIMD is the evolutionary step inside OAuth.
At a glance
Actors
01
DCR does not scale well for open-world clients (MCP clients, decentralized apps). CIMD lets the client_id be an HTTPS URL that the AS fetches for metadata. This is the OAuth WG's answer to 'my agent did not pre-register'. AAuth goes further and drops the AS-issued client_id; CIMD is the evolutionary step inside OAuth.
MCP 2026-07-28 prefers CIMD over DCR but still cites draft-00; the WG draft fetched 15 September 2026 remains draft-02 (expires 7 January 2027). Implement -02, not the MCP citation.
02
The AS fetches a URL the client named. That is SSRF. HTTPS only, no userinfo, must contain a path, no fragment, simple string comparison (https://example.com/client and https://example.com:443/client are not equal). Document client_id MUST match the fetched URL. Shared secrets as client auth are prohibited; public-key methods such as private_key_jwt are allowed.
Localhost and ephemeral URLs are a poor fit — the draft says this works best for clients with a stable public web presence. Dev-loop agents may still need DCR or pre-registration (see the draft's §7 / §8.10 guidance).
03
Client uses its metadata URL as client_id. AS fetches JSON (200, JSON content type), checks client_id inside matches, uses redirect_uris, jwks, client_name, token_endpoint_auth_method, etc. AS advertises support in RFC 8414 metadata. MCP clients SHOULD check for that capability and MAY fall back to DCR.
04
Flow 1
Publisher hosts https://agent.example/oauth-client.json with matching client_id, redirect_uris, jwks.
Agent starts authorize with client_id=that URL and PKCE.
AS fetches the document, validates match and TLS, caches per policy.
User sees the name/icon from the document. Token request uses private_key_jwt (or other public-key method).
05
Client identity without a registration handshake. The URL is the identifier; the JSON is the metadata. User identity remains OIDC. API authorization remains the access token.
06
CIMD avoids the registration POST. MCP: CIMD SHOULD, DCR MAY deprecated.
Preferred registration mechanism; spec citation lags at draft-00.
Advertises CIMD support.
AAuth's portable agent identifier is a different answer to the same open-world problem.
private_key_jwt is the natural client auth.
07
The AS is now an HTTP client of arbitrary URLs. Allow-lists, scheme checks, no link-local, size limits, cache carefully.
Simple string comparison. Rotating the path is a new identity; users re-consent.
Implement draft-02 (or current datatracker), not the -00 cited in MCP 2026-07-28.
08
draft-ietf-oauth-client-id-metadata-document-02, expires 7 January 2027 (implies ~6 July 2026 publication), OAuth WG, not an RFC. Authors: A. Parecki, E. Smith. https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/. You can ship behind AS support; pin the draft.
WG document, not an RFC. MCP 2026-07-28 prefers CIMD over DCR (the MCP spec still cites draft-00; the WG draft in July 2026 was -02). AS must consider SSRF when fetching client URLs.