{"schema_version":2,"registry_id":"oauth_registry","dataset_id":"oauth_dynamic_client_registration_metadata","name":"OAuth Dynamic Client Registration Metadata","metadata":{"datasource_url":"https://www.iana.org/assignments/oauth-parameters/client-metadata.csv","required_specifications":["RFC7591"],"last_updated_iso":"2026-05-25T06:35:27.567Z"},"entries":[{"entry_id":"application_type","client_metadata_name":"application_type","client_metadata_description":"Kind of the application -- \"native\" or \"web\"","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"authorization_details_types","client_metadata_name":"authorization_details_types","client_metadata_description":"Indicates what authorization details types the client uses.","change_controller":"IETF","reference":"RFC9396 - Section 10"},{"entry_id":"backchannel_logout_session_required","client_metadata_name":"backchannel_logout_session_required","client_metadata_description":"Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the OP when the backchannel_logout_uri is used","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Back-Channel Logout 1.0 - Section 2.2"},{"entry_id":"backchannel_logout_uri","client_metadata_name":"backchannel_logout_uri","client_metadata_description":"RP URL that will cause the RP to log itself out when sent a Logout Token by the OP","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Back-Channel Logout 1.0 - Section 2.2"},{"entry_id":"claims_redirect_uris","client_metadata_name":"claims_redirect_uris","client_metadata_description":"claims redirection endpoints","change_controller":"Kantara_UMA_WG","reference":"UMA 2.0 Grant for OAuth 2.0 - Section 2"},{"entry_id":"client_id","client_metadata_name":"client_id","client_metadata_description":"Client identifier","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"client_id_issued_at","client_metadata_name":"client_id_issued_at","client_metadata_description":"Time at which the client identifier was issued","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"client_name","client_metadata_name":"client_name","client_metadata_description":"Human-readable name of the client to be presented to the user","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"client_registration_types","client_metadata_name":"client_registration_types","client_metadata_description":"An array of strings specifying the client registration types the RP wants to use","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"Section 5.1.2 of OpenID Federation 1.0"},{"entry_id":"client_secret","client_metadata_name":"client_secret","client_metadata_description":"Client secret","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"client_secret_expires_at","client_metadata_name":"client_secret_expires_at","client_metadata_description":"Time at which the client secret will expire","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"client_uri","client_metadata_name":"client_uri","client_metadata_description":"URL of a web page providing information about the client","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"contacts","client_metadata_name":"contacts","client_metadata_description":"Array of strings representing ways to contact people responsible for this client, typically email addresses","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"default_acr_values","client_metadata_name":"default_acr_values","client_metadata_description":"Default requested Authentication Context Class Reference values","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"default_max_age","client_metadata_name":"default_max_age","client_metadata_description":"Default Maximum Authentication Age","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"description","client_metadata_name":"description","client_metadata_description":"Human-readable brief description of this client presentable to the End-User","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"Section 5.2.2 of OpenID Federation 1.0"},{"entry_id":"dpop_bound_access_tokens","client_metadata_name":"dpop_bound_access_tokens","client_metadata_description":"Boolean value specifying whether the client always uses DPoP for token requests","change_controller":"IETF","reference":"RFC9449 - Section 5.2"},{"entry_id":"encrypted_response_enc_values_supported","client_metadata_name":"encrypted_response_enc_values_supported","client_metadata_description":"Non-empty array of strings, where each string is a JWE RFC7516 enc algorithm that can be used as the content encryption algorithm for encrypting the Response","change_controller":"OpenID_Foundation_Digital_Credentials_Protocols_WG","reference":"Section 5.1 of OpenID for Verifiable Presentations 1.0"},{"entry_id":"frontchannel_logout_session_required","client_metadata_name":"frontchannel_logout_session_required","client_metadata_description":"Boolean value specifying whether the RP requires that a sid (session ID) query parameter be included to identify the RP session with the OP when the frontchannel_logout_uri is used","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Front-Channel Logout 1.0 - Section 2"},{"entry_id":"frontchannel_logout_uri","client_metadata_name":"frontchannel_logout_uri","client_metadata_description":"RP URL that will cause the RP to log itself out when rendered in an iframe by the OP","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Front-Channel Logout 1.0 - Section 2"},{"entry_id":"grant_types","client_metadata_name":"grant_types","client_metadata_description":"Array of OAuth 2.0 grant types that the client may use","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"id_token_encrypted_response_alg","client_metadata_name":"id_token_encrypted_response_alg","client_metadata_description":"JWE alg algorithm REQUIRED for encrypting the ID Token issued to this Client","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"id_token_encrypted_response_enc","client_metadata_name":"id_token_encrypted_response_enc","client_metadata_description":"JWE enc algorithm REQUIRED for encrypting the ID Token issued to this Client","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"id_token_signed_response_alg","client_metadata_name":"id_token_signed_response_alg","client_metadata_description":"JWS alg algorithm REQUIRED for signing the ID Token issued to this Client","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"information_uri","client_metadata_name":"information_uri","client_metadata_description":"URL for documentation of additional information about this client viewable by the End-User","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"Section 5.2.2 of OpenID Federation 1.0"},{"entry_id":"initiate_login_uri","client_metadata_name":"initiate_login_uri","client_metadata_description":"URI using the https scheme that a third party can use to initiate a login by the RP","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"introspection_encrypted_response_alg","client_metadata_name":"introspection_encrypted_response_alg","client_metadata_description":"String value specifying the desired introspection response content key encryption algorithm (alg value)","change_controller":"IETF","reference":"RFC9701 - Section 6"},{"entry_id":"introspection_encrypted_response_enc","client_metadata_name":"introspection_encrypted_response_enc","client_metadata_description":"String value specifying the desired introspection response content encryption algorithm (enc value)","change_controller":"IETF","reference":"RFC9701 - Section 6"},{"entry_id":"introspection_signed_response_alg","client_metadata_name":"introspection_signed_response_alg","client_metadata_description":"String value indicating the client’s desired introspection response signing algorithm","change_controller":"IETF","reference":"RFC9701 - Section 6"},{"entry_id":"jwks","client_metadata_name":"jwks","client_metadata_description":"Client's JSON Web Key Set RFC7517 document representing the client's public keys","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"jwks_uri","client_metadata_name":"jwks_uri","client_metadata_description":"URL referencing the client's JSON Web Key Set RFC7517 document representing the client's public keys","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"keywords","client_metadata_name":"keywords","client_metadata_description":"JSON array with one or more strings representing search keywords, tags, categories, or labels that apply to this client","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"Section 5.2.2 of OpenID Federation 1.0"},{"entry_id":"logo_uri","client_metadata_name":"logo_uri","client_metadata_description":"URL that references a logo for the client","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"nfv_token_encrypted_response_alg","client_metadata_name":"nfv_token_encrypted_response_alg","client_metadata_description":"JWE alg algorithm required for encrypting the nfv Token issued to this Client","change_controller":"ETSI","reference":"ETSI GS NFV-SEC 022 V2.7.1"},{"entry_id":"nfv_token_encrypted_response_enc","client_metadata_name":"nfv_token_encrypted_response_enc","client_metadata_description":"JWE enc algorithm required for encrypting the nfv Token issued to this Client","change_controller":"ETSI","reference":"ETSI GS NFV-SEC 022 V2.7.1"},{"entry_id":"nfv_token_signed_response_alg","client_metadata_name":"nfv_token_signed_response_alg","client_metadata_description":"JWS alg algorithm required for signing the nfv Token issued to this Client","change_controller":"ETSI","reference":"ETSI GS NFV-SEC 022 V2.7.1"},{"entry_id":"organization_name","client_metadata_name":"organization_name","client_metadata_description":"Human-readable name representing the organization owning this client","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"Section 5.2.2 of OpenID Federation 1.0"},{"entry_id":"organization_uri","client_metadata_name":"organization_uri","client_metadata_description":"URL of a Web page for the organization owning this client","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"Section 5.2.2 of OpenID Federation 1.0"},{"entry_id":"policy_uri","client_metadata_name":"policy_uri","client_metadata_description":"URL that points to a human-readable policy document for the client","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"post_logout_redirect_uris","client_metadata_name":"post_logout_redirect_uris","client_metadata_description":"Array of URLs supplied by the RP to which it MAY request that the End-User's User Agent be redirected using the post_logout_redirect_uri parameter after a logout has been performed","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect RP-Initiated Logout 1.0 - Section 3.1"},{"entry_id":"redirect_uris","client_metadata_name":"redirect_uris","client_metadata_description":"Array of redirection URIs for use in redirect-based flows","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"registration_access_token","client_metadata_name":"registration_access_token","client_metadata_description":"OAuth 2.0 Bearer Token used to access the client configuration endpoint","change_controller":"IESG","reference":"RFC7592"},{"entry_id":"registration_client_uri","client_metadata_name":"registration_client_uri","client_metadata_description":"Fully qualified URI of the client registration endpoint","change_controller":"IESG","reference":"RFC7592"},{"entry_id":"request_object_encryption_alg","client_metadata_name":"request_object_encryption_alg","client_metadata_description":"JWE alg algorithm the RP is declaring that it may use for encrypting Request Objects sent to the OP","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"request_object_encryption_enc","client_metadata_name":"request_object_encryption_enc","client_metadata_description":"JWE enc algorithm the RP is declaring that it may use for encrypting Request Objects sent to the OP","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"request_object_signing_alg","client_metadata_name":"request_object_signing_alg","client_metadata_description":"JWS alg algorithm that MUST be used for signing Request Objects sent to the OP","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"request_uris","client_metadata_name":"request_uris","client_metadata_description":"Array of request_uri values that are pre-registered by the RP for use at the OP","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"require_auth_time","client_metadata_name":"require_auth_time","client_metadata_description":"Boolean value specifying whether the auth_time Claim in the ID Token is REQUIRED","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"require_pushed_authorization_requests","client_metadata_name":"require_pushed_authorization_requests","client_metadata_description":"Indicates whether the client is required to use PAR to initiate authorization requests.","change_controller":"IESG","reference":"RFC9126 - Section 6"},{"entry_id":"require_signed_request_object","client_metadata_name":"require_signed_request_object","client_metadata_description":"Indicates where authorization request needs to be protected as Request Object and provided through either request or request_uri parameter.","change_controller":"IETF","reference":"RFC9101 - Section 10.5"},{"entry_id":"response_types","client_metadata_name":"response_types","client_metadata_description":"Array of the OAuth 2.0 response types that the client may use","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"scope","client_metadata_name":"scope","client_metadata_description":"Space-separated list of OAuth 2.0 scope values","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"sector_identifier_uri","client_metadata_name":"sector_identifier_uri","client_metadata_description":"URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"signed_jwks_uri","client_metadata_name":"signed_jwks_uri","client_metadata_description":"URL referencing a signed JWT having the client's JWK Set document as its payload","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"Section 5.2.1 of OpenID Federation 1.0"},{"entry_id":"software_id","client_metadata_name":"software_id","client_metadata_description":"Identifier for the software that comprises a client","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"software_statement","client_metadata_name":"software_statement","client_metadata_description":"A software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"software_version","client_metadata_name":"software_version","client_metadata_description":"Version identifier for the software that comprises a client","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"subject_type","client_metadata_name":"subject_type","client_metadata_description":"subject_type requested for responses to this Client -- \"pairwise\" or \"public\"","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"tls_client_auth_san_dns","client_metadata_name":"tls_client_auth_san_dns","client_metadata_description":"String value specifying the expected dNSName SAN entry in the client certificate.","change_controller":"IESG","reference":"RFC8705 - Section 2.1.2"},{"entry_id":"tls_client_auth_san_email","client_metadata_name":"tls_client_auth_san_email","client_metadata_description":"String value specifying the expected rfc822Name SAN entry in the client certificate.","change_controller":"IESG","reference":"RFC8705 - Section 2.1.2"},{"entry_id":"tls_client_auth_san_ip","client_metadata_name":"tls_client_auth_san_ip","client_metadata_description":"String value specifying the expected iPAddress SAN entry in the client certificate.","change_controller":"IESG","reference":"RFC8705 - Section 2.1.2"},{"entry_id":"tls_client_auth_san_uri","client_metadata_name":"tls_client_auth_san_uri","client_metadata_description":"String value specifying the expected uniformResourceIdentifier SAN entry in the client certificate.","change_controller":"IESG","reference":"RFC8705 - Section 2.1.2"},{"entry_id":"tls_client_auth_subject_dn","client_metadata_name":"tls_client_auth_subject_dn","client_metadata_description":"String value specifying the expected subject DN of the client certificate.","change_controller":"IESG","reference":"RFC8705 - Section 2.1.2"},{"entry_id":"tls_client_certificate_bound_access_tokens","client_metadata_name":"tls_client_certificate_bound_access_tokens","client_metadata_description":"Indicates the client's intention to use mutual-TLS client certificate-bound access tokens.","change_controller":"IESG","reference":"RFC8705 - Section 3.4"},{"entry_id":"token_endpoint_auth_method","client_metadata_name":"token_endpoint_auth_method","client_metadata_description":"Requested authentication method for the token endpoint","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"token_endpoint_auth_signing_alg","client_metadata_name":"token_endpoint_auth_signing_alg","client_metadata_description":"JWS alg algorithm that MUST be used for signing the JWT used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"tos_uri","client_metadata_name":"tos_uri","client_metadata_description":"URL that points to a human-readable terms of service document for the client","change_controller":"IESG","reference":"RFC7591"},{"entry_id":"use_mtls_endpoint_aliases","client_metadata_name":"use_mtls_endpoint_aliases","client_metadata_description":"Boolean value indicating the requirement for a client to use mutual-TLS endpoint aliases RFC8705 declared by the authorization server in its metadata even beyond the Mutual-TLS Client Authentication and Certificate-Bound Access Tokens use cases.","change_controller":"OpenID_Foundation_FAPI_WG","reference":"Section 5.2.2.1.1 of FAPI 2.0 Security Profile"},{"entry_id":"userinfo_encrypted_response_alg","client_metadata_name":"userinfo_encrypted_response_alg","client_metadata_description":"JWE alg algorithm REQUIRED for encrypting UserInfo Responses","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"userinfo_encrypted_response_enc","client_metadata_name":"userinfo_encrypted_response_enc","client_metadata_description":"JWE enc algorithm REQUIRED for encrypting UserInfo Responses","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"userinfo_signed_response_alg","client_metadata_name":"userinfo_signed_response_alg","client_metadata_description":"JWS alg algorithm REQUIRED for signing UserInfo Responses","change_controller":"OpenID_Foundation_Artifact_Binding_WG","reference":"OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 2"},{"entry_id":"vp_formats_supported","client_metadata_name":"vp_formats_supported","client_metadata_description":"An object containing a list of name/value pairs, where the name is a string identifying a Credential format supported by the Verifier","change_controller":"OpenID_Foundation_Digital_Credentials_Protocols_WG","reference":"Section 11.1 of OpenID for Verifiable Presentations 1.0"}]}