oauth2.dev

invalid_client_metadata

IETF

Registry Context

Returned when a client registration request contains invalid client metadata and the authorization server rejects the request.

Technical Summary

RFC 7591 defines invalid_client_metadata as the OAuth Dynamic Client Registration error code used when a client metadata value is invalid and the server rejects the registration request.

When Used

When a registration request contains invalid client metadata and the authorization server chooses to reject the request rather than substitute defaults.

Normative Requirements

Authorization servers

MUST
1
  1. RFC 7591 - Section 3.2.2

    return an HTTP 400 status code unless otherwise specified, with content type "application/json" consisting of a JSON object in the response body.

    Condition: when a registration error condition occurs

    returns an HTTP 400 status code

REQUIRED
1
  1. RFC 7591 - Section 3.2.2

    include an error member containing a single ASCII error code string.

    Condition: when constructing a client registration error response

    error REQUIRED. Single ASCII error code string.

MAY
2
  1. RFC 7591 - Section 2

    reject any requested client metadata values by replacing requested values with suitable defaults.

    Condition: when a registration request contains invalid client metadata

    MAY reject any requested client metadata values

  2. RFC 7591 - Section 2

    return an error response as described in Section 3.2.2.

    Condition: when a registration request contains invalid client metadata

    or by returning an error response

Validation Guidance

error

Ensure the emitted error code value is exactly `invalid_client_metadata` when this condition applies.

error

When rejecting a registration request for invalid metadata, verify the response is HTTP 400 with `Content-Type: application/json`.

warning

If the server substitutes a valid metadata value instead of rejecting the request, do not emit this error code.

Reference

Details

Entry Id
invalid_client_metadata
Name
invalid_client_metadata
Usage Location
registration endpoint
Protocol Extension
Dynamic Client Registration
Change Controller
IETF
Reference
RFC7591 - Section 3.2.2