cimd
Templates Validator DEV ONLY

CIMD Validator

Check a Client ID Metadata Document against the CIMD draft and the RFC 7591 metadata registry. Paste a client_id URL to fetch and check it live, or paste raw JSON to check a document before you host it.

Fetched server-side. Redirects are not followed, per the draft.

Fields

What this validator checks against the RFC 7591 registry and the CIMD draft's restrictions on top of it.

Required

client_id string (URL) Always required. Must be the exact https URL the document is served from — no userinfo, has a path, no "." / ".." segments, no fragment.
redirect_uris array of URIs Required when the client uses the authorization code or implicit flow. Absolute redirect URIs.
jwks or jwks_uri object / string (URL) Required (one of the two) when token_endpoint_auth_method is private_key_jwt, to publish the public key used to verify the client assertion.

Recommended

client_name string Human-readable name shown to end users during consent.
token_endpoint_auth_method string "none" or "private_key_jwt" only. Shared-secret methods (client_secret_post/basic/jwt) are forbidden for CIMD clients.
client_uri string (URL) The client application's homepage.
logo_uri string (URL) Authorization servers are expected to prefetch and cache this, not hotlink it.

Optional

grant_types array of strings From the OAuth Dynamic Client Registration grant type registry.
response_types array of strings From the OAuth Dynamic Client Registration response type registry.
scope string (space-delimited) Requested scopes; the authorization server may restrict these regardless.
policy_uri string (URL) Privacy policy link.
tos_uri string (URL) Terms of service link.
contacts array of strings Contact addresses for the client operator.
software_id string Identifier for the client software, shared across instances/versions.
software_version string Version of the client software.
client_id_expires_at number (unix time) Non-normative extension for ephemeral/provisioned clients; server-assigned, informative only.

Forbidden

client_secret — MUST NOT be present. CIMD clients are public or use asymmetric auth, never a shared secret.
client_secret_expires_at — MUST NOT be present, for the same reason.
token_endpoint_auth_method = client_secret_* — client_secret_post, client_secret_basic, and client_secret_jwt are all forbidden.
private/symmetric members inside jwks — "d", "p", "q", "dp", "dq", "qi", "k" must never appear — jwks is public-key-only.

Checklist

What an authorization server is expected to check before it trusts a client_id URL and the document behind it — and what this validator applies.

  • ✓ client_id uses the https scheme, with no userinfo component.
  • ✓ client_id has a path component, and that path contains no "." or ".." segments.
  • ✓ client_id has no fragment; a query component is discouraged but not forbidden.
  • ✓ The document's own "client_id" field matches the URL it was fetched from, via exact string comparison.
  • ✓ The fetch is not redirected automatically — a non-200 response (including 3xx) is treated as invalid.
  • ✓ The response body is capped at 5 KB; oversized responses are rejected.
  • ✓ The document is well-formed JSON and a top-level object (RFC 8259).
  • ✓ No client_secret, client_secret_expires_at, or shared-secret auth method is present.
  • ✓ Any jwks entries are public keys only — no private or symmetric key members.
  • ✓ Unrecognized top-level fields are rejected unless namespaced (contain a ":") as an extension.
  • ✓ private_key_jwt as token_endpoint_auth_method is paired with a jwks or jwks_uri.