invalid_client_metadata

Docs version v1 (main) · Nauthera is pre-1.0, in a design-partner program

A client metadata value in a dynamic registration is invalid or not permitted (RFC 7591 §3.2.2).

#Meaning

Sent by /register and PUT /register/{client_id} with 400 when the body is missing, or a metadata field is unsupported or not permitted by the registration policy: grant types other than authorization_code, refresh_token, and implicit where issuer.implicit_flow is on, a response type or token_endpoint_auth_method this server does not serve, inconsistent grant and response types, an id_token_signed_response_alg the organization cannot sign with, a scope outside openid, profile and email or any nauthera.* scope, an invalid URI in a non-redirect field, empty list entries, a private_key_jwt client with neither a jwks_uri nor a jwks, both together, or a jwks that holds a private key or no key this server can verify with. On an update, a client_id or client_secret in the body that does not match the registration.

#Impact

The client is not registered or updated. No user is affected yet.

#Diagnosis

1. error_description names the field and, where useful, the supported values.
2. The client.registration.attempted record has reason invalid_client_metadata, the metadata field, and a cause such as value_unsupported, value_not_permitted, grant_response_mismatch, scope_reserved, blank_entry, or one of the jwks_* causes for a refused jwks.

#Mitigation

• As a client developer: send only the values the discovery document and the registration policy allow. See Dynamic client registration.
• As an operator: the registration policy is fixed in code; a client that needs more is registered through the operator or the AdminService.
• As a user: nothing to do.

#Escalation

If a value the docs list as allowed is refused, open an issue with the request id, the server version and the field. Never attach the initial or registration access token.

OAuth error runbooks · Generated from internal/runbook/oauth.yaml in nauthera-server.