Connect OAuth clients with Client ID Metadata Documents

Clerk's OAuth provider now supports Client ID Metadata Documents⁠ (CIMD), available today as a beta.

A compatible client uses an HTTPS URL as its client_id. Clerk fetches the metadata document at that URL and validates the client's identity and redirect URIs. This gives MCP and other public OAuth clients a stable identity without a pre-issued client ID, client secret, or Dynamic Client Registration.

Control which clients can connect

The new CIMD Clients tab on the OAuth applications⁠ page lets you:

• Explicitly allow a client by its Client ID URL and choose its scopes.
• Allow supported popular clients with suggested scopes.
• Review each client's admission status and metadata fetch health.
• Edit scopes, refresh metadata, or delete a saved client.
• Decide whether unknown clients may connect.
• Block clients that were implicitly allowed during an earlier connection.

Enable Advertise CIMD support to publish CIMD in your authorization server metadata. Once you do, any CIMD client can connect and Clerk records it when it first connects so you can review it later. Enable Only allow pre-registered clients to connect at the same time to restrict OAuth flows to clients you've reviewed in advance.

Get started

CIMD is currently available in beta. To try it, contact support⁠ to enable it for your workspace.

Read Manage OAuth clients with Client ID Metadata Documents to learn how CIMD works and how to configure client admission policies.

We'd love to hear your feedback as you try out CIMD. Your input during the beta period will help us refine the feature. Have questions or suggestions? Reach out through our feedback portal⁠ or join the discussion in our Discord community⁠.