OAuth Client ID Metadata Documents

Easy MCP AI can identify a public OAuth client by the HTTPS URL that serves its JSON metadata document. This is an alternative to dynamically registering a client ID. WordPress sign-in and user consent still apply.

In this article

• Publish a metadata document
• Metadata URL requirements
• Discovery and Dynamic Client Registration
• Disable metadata-document support

Publish a metadata document

Serve a JSON document at the exact URL you use as the client's client_id. Replace the example domain with your public client domain:

{
  "client_id": "https://client.example.com/oauth/client.json",
  "client_name": "Example MCP Client",
  "redirect_uris": ["https://client.example.com/oauth/callback"],
  "token_endpoint_auth_method": "none"
}

The document must include a nonempty client_name, the exact URL in client_id, and at least one redirect_uris entry accepted by the server. Do not publish client_secret or client_secret_expires_at. Metadata-document clients must use public-client authentication, with token_endpoint_auth_method set to none.

Metadata URL requirements

The client_id URL must use HTTPS, have a DNS hostname, and use port 443 if a port is specified. It must include a path other than /. User information, query strings, fragments, percent-encoding, and dot segments are not accepted. The hostname must resolve to public IP addresses, and WordPress must be able to safely reach the URL.

Discovery and Dynamic Client Registration

Check the authorization server's OAuth metadata for client_id_metadata_document_supported before using this method; support is not always advertised. The server advertises it only when metadata-document support is enabled, its schema is ready, new-client registration is allowed, IPv6 DNS lookup is available, and a recent outbound connection check succeeded.

Dynamic Client Registration (DCR) controls whether clients can register with the server. If DCR is disabled, new metadata-document clients are also blocked. Clients that are already stored can continue signing in.

Disable metadata-document support

Support is enabled by default and has no settings-screen switch. To opt out, add this to wp-config.php:

define( 'EASY_MCP_AI_OAUTH_CIMD', false );

You can also set the EASY_MCP_AI_OAUTH_CIMD environment variable to false.