OAuth Client ID Metadata Document (CIMD)

An OAuth Client ID Metadata Document (CIMD) is a JSON document of client metadata hosted at an HTTPS URL that the client uses as its client_id, so an authorization server can fetch and verify the client's details on first contact without any prior registration. It is specified in draft-ietf-oauth-client-id-metadata-document, an active IETF OAuth Working Group draft that is not yet an RFC as of October 2026.

CIMD solves the open-ecosystem problem: thousands of AI clients connecting to thousands of servers that have never met. Dynamic Client Registration (RFC 7591) handles that by letting anyone create a client, which fills authorization servers with unverifiable, unbounded registrations. With CIMD the client's identity is a URL the server can check, cache, and allow or block by domain, and the redirect URIs come from a document the client's owner controls. The Model Context Protocol authorization spec tells clients to prefer CIMD over Dynamic Client Registration when the server advertises client_id_metadata_document_supported. Servers fetching the URL need SSRF protection (the draft has a section on it), and a valid document proves control of a domain, not that the client is trustworthy, so consent screens still need to show that domain clearly.

See also: dynamic client registration, MCP authorization, authorization server metadata, authorization server, Aaron Parecki, agent identity standards map 2026