cimd DEV ONLY
OAuth Client ID Metadata Documents

OAuth client identity,
served as a URL.

CIMD lets an OAuth client identify itself with a URL instead of a pre-registered client ID. The URL points to a JSON document containing the client's metadata.

Browse templates → Read the IETF draft

What is a CIMD?

A Client ID Metadata Document is a JSON document served at a stable HTTPS URL. It contains familiar OAuth registration metadata such as client_name, client_uri, and redirect_uris.

Why use one?

The URL is the client_id. An authorization server can fetch and validate the document when needed, removing the need to register the same client separately with every server.

How CIMD works

The metadata document is the registration.

01

Host metadata

Serve a JSON document at an HTTPS URL. Its client_id must exactly match that URL.

02

Use the URL

Pass the metadata URL as client_id in the OAuth authorization request.

03

Server validates it

The authorization server fetches the JSON, checks its fields, and can display the client identity during consent.

{
  "client_id": "https://example.com/oauth/client-metadata.json",
  "client_name": "My OAuth app",
  "redirect_uris": ["https://example.com/oauth/callback"],
  "token_endpoint_auth_method": "none"
}

CIMD templates

https://cimd.cerberauth.com lists reusable templates for common OAuth clients. Start with one locally, then update its values for your application.

↗

From local development to production

Copy a template and replace the example metadata, especially client_id, redirect URIs, and application details. For production, serve the updated document from a permanent HTTPS URL on a domain you control. Development templates and expiring service URLs are not production client identities.

Need a URL for local OAuth?

The CIMD service can provision a temporary document for development, including localhost redirect URIs. Provisioned documents expire and are for development and testing only.

curl -X POST https://cimd.cerberauth.com/api/clients \
  -H "Authorization: Bearer $CIMD_API_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"client_name":"My Dev App","redirect_uris":["http://localhost:5173/callback"],"token_endpoint_auth_method":"none"}'