Client Registration changedspecification/draft/basic/authorization/client-registration
Nearest release: v2.1.321, published 16 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 9 Nov 2026 03:02 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 9 Nov 2026 03:07 UTC.
Upstream edited
Recorded here
Lines+4added
Lines−4removed
From line
16
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits6to this page, all time
The whole hunk
from line 16, old and new numbered
/
from line 16
1616## Client ID Metadata Documents
1717
1818MCP clients and authorization servers **SHOULD** support OAuth Client ID Metadata Documents as specified in
19[OAuth Client ID Metadata Document](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00)
19[OAuth Client ID Metadata Document](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-03)
2020for client registration.
2121
2222This approach enables clients to use HTTPS URLs as client identifiers, where the URL points to a JSON document
from line 26
2626### Implementation Requirements
2727
2828MCP implementations supporting Client ID Metadata Documents **MUST** follow the requirements specified in
29[OAuth Client ID Metadata Document](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00).
29[OAuth Client ID Metadata Document](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-03).
3030Key requirements include:
3131
3232**For MCP Clients:**
from line 35
3535* The `client_id` URL **MUST** use the "https" scheme and contain a path component, e.g. `https://example.com/client.json`
3636* The metadata document **MUST** include at least the following properties: `client_id`, `client_name`, `redirect_uris`
3737* Clients **MUST** ensure the `client_id` value in the metadata matches the document URL exactly
38* Clients **MAY** use `private_key_jwt` for client authentication (e.g., for requests to the token endpoint) with appropriate JWKS configuration as described in [Section 6.2 of Client ID Metadata Document](https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html#section-6.2)
38* Clients **MAY** use `private_key_jwt` for client authentication (e.g., for requests to the token endpoint) with appropriate JWKS configuration as described in [Section 5 of Client ID Metadata Document](https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-03.html#section-5)
3939
4040**For Authorization Servers:**
4141
from line 44
4444* **SHOULD** cache metadata respecting HTTP cache headers
4545* **MUST** validate redirect URIs presented in an authorization request against those in the metadata document
4646* **MUST** validate the document structure is valid JSON and contains required fields
47* **SHOULD** follow the security considerations in [Section 6 of Client ID Metadata Document](https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html#section-6) and in [Client ID Metadata Document Security](https://modelcontextprotocol.io/specification/draft/basic/authorization/security-considerations.md#client-id-metadata-document-security)
47* **SHOULD** follow the security considerations in [Section 10 of Client ID Metadata Document](https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-03.html#section-10) and in [Client ID Metadata Document Security](https://modelcontextprotocol.io/specification/draft/basic/authorization/security-considerations.md#client-id-metadata-document-security)
4848
4949### Example Metadata Document
5050
No line in this hunk matches that.