OAuth Client ID Metadata Document (CIMD)
IETF OAuth draft letting a client identify itself with a URL as its client_id, pointing to a metadata document, without prior dynamic registration.
Tags
Description
The MCP authorization spec (2026-07-28) says authorization servers and MCP clients SHOULD support Client ID Metadata Documents; WorkOS AuthKit and Auth0 document CIMD support.
Related
- MCP Authorization (OAuth 2.1 for MCP): The MCP specification's transport-level authorization flow for HTTP-based MCP servers, based on a subset of OAuth 2.1 and related RFCs.
- WorkOS AuthKit for MCP: WorkOS AuthKit guide and support for securing MCP servers that require authentication.
- Auth0 for AI Agents: Auth0's identity toolkit for AI agents: user authentication, delegated authorization, human-in-the-loop (CIBA) and fine-grained authorization for RAG.
Guides & comparisons
- Add OAuth authorization to your own MCP server (Guide): A server-side walkthrough of the MCP 2026-07-28 authorization spec: publish RFC 9728 protected resource metadata, answer 401 and 403 challenges, verify JWT audience per RFC 8707, enforce per-tool scopes, and never pass tokens through. Tested with the MCP TypeScript SDK v2.
- Agent auth and delegated access, step by step (Guide): How an agent acts for a user without holding their passwords: CIMD client registration, the MCP 2026-07-28 OAuth flow with resource indicators and audience checks, no token passthrough, vaulted third-party tokens, CIBA approvals and Cross App Access (ID-JAG).
- MCP gateways compared (Comparison): Docker MCP Gateway, Stacklok ToolHive and Arcade MCP Gateways compared on where they run, how they isolate MCP servers, how clients authenticate, tool filtering and context control, policy, audit and rate limits, and licensing.
Sources
- https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/
- https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization
Machine-readable
- JSON
- Markdown
- Source file on GitHub (edit via pull request)