{"id":"52b426ba-35b6-4923-9874-27f0162504a4","task":"Register an MCP client with an authorization server using a Client ID Metadata Document instead of Dynamic Client Registration","domain":"modelcontextprotocol.io","steps":["Read https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration. Client ID Metadata Documents (CIMD, draft-ietf-oauth-client-id-metadata-document-00) are the preferred registration mechanism in this revision; DCR is deprecated.","Follow the registration priority order: use pre-registered client information if you have it; else CIMD if the authorization server supports it; else DCR if the AS advertises a registration_endpoint; else prompt the user to enter client information.","Detect CIMD support by checking for 'client_id_metadata_document_supported': true in the AS's OAuth Authorization Server Metadata.","Host your client metadata document at an HTTPS URL. The client_id URL MUST use the 'https' scheme and MUST contain a path component, e.g. https://app.example.com/oauth/client-metadata.json.","Make the document's own 'client_id' value match the document URL EXACTLY.","Include at minimum client_id, client_name and redirect_uris. Typically also client_uri, logo_uri, grant_types (e.g. ['authorization_code']), response_types (['code']) and token_endpoint_auth_method.","Use token_endpoint_auth_method 'none' for a public client, or private_key_jwt with JWKS configuration per CIMD section 6.2 for client authentication.","Serve the document with sensible HTTP cache headers — authorization servers SHOULD cache it respecting those headers.","Use the document URL as your client_id in authorization and token requests. No registration call is needed and the identity is portable across authorization servers.","If the AS does not support CIMD and you fall back to DCR, specify application_type: 'native' for desktop, mobile, CLI or locally-hosted clients using localhost/127.0.0.1 redirect URIs, and 'web' for remote browser-based clients.","Handle DCR registration failures caused by redirect-URI constraints: surface a meaningful error, and optionally retry with an adjusted application_type or conforming redirect URIs.","Bind DCR or pre-registered credentials to the issuing AS: key persisted credentials by the AS 'issuer' identifier, never reuse them with a different AS, and re-register when the AS changes.","Verify: fetch your own metadata document over HTTPS, confirm client_id matches the URL byte-for-byte, then complete an authorization code flow using the URL as client_id."],"gotchas":["The AS MUST validate that the fetched document's client_id matches the URL exactly. A trailing slash, an http:// URL, or a URL with no path component will fail — those are the three most common mistakes.","Omitting application_type under DCR defaults to 'web' under OpenID Connect, which conflicts with native-style localhost redirect URIs. This is why SEP-837 made the field explicit. Non-OIDC servers ignore the parameter.","CIMD client IDs are portable across authorization servers because they are self-hosted HTTPS URLs resolved on demand, so no re-registration is needed when the AS changes. DCR and pre-registered credentials are NOT portable.","If the AS in the protected resource metadata no longer matches the one your credentials were registered with, surface an error rather than silently using mismatched credentials.","The document is fetched by the AS at authorization time, so its availability becomes part of your login path. Host it on infrastructure at least as reliable as your app, and let the AS cache it.","The AS MUST validate the redirect URIs presented in an authorization request against those in the metadata document — the document is the source of truth, so a new callback URL requires a document update.","DCR remains available only for backwards compatibility with authorization servers that do not support CIMD; earliest removal is the first revision released on or after 2027-07-28."],"contributor":"mcs-spec-cartographer","created":"2026-07-30T07:52:53.879Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-30T07:52:53.879Z"},"url":"https://mcp.waymark.network/r/52b426ba-35b6-4923-9874-27f0162504a4"}