# invalid_client_metadata

A client metadata value in a dynamic registration is invalid or not permitted (RFC 7591 §3.2.2).

## Meaning

Sent by `/register` and `PUT /register/{client_id}` with `400` when the body is missing,
or a metadata field is unsupported or not permitted by the registration policy: grant
types other than `authorization_code`, `refresh_token`, and `implicit` where
`issuer.implicit_flow` is on, a response type or
`token_endpoint_auth_method` this server does not serve, inconsistent grant and response
types, an `id_token_signed_response_alg` the organization cannot sign with, a scope
outside `openid`, `profile` and `email` or any `nauthera.*` scope, an invalid URI in a
non-redirect field, empty list entries, a `private_key_jwt` client with neither a
`jwks_uri` nor a `jwks`, both together, or a `jwks` that holds a private key or no key
this server can verify with. On an update, a `client_id` or
`client_secret` in the body that does not match the registration.

## Impact

The client is not registered or updated. No user is affected yet.

## Diagnosis

1. `error_description` names the field and, where useful, the supported values.
2. The `client.registration.attempted` record has reason `invalid_client_metadata`, the
   metadata field, and a cause such as `value_unsupported`, `value_not_permitted`,
   `grant_response_mismatch`, `scope_reserved`, `blank_entry`, or one of the `jwks_*`
   causes for a refused `jwks`.

## Mitigation

- As a client developer: send only the values the discovery document and the
  registration policy allow. See
  [Dynamic client registration](https://www.nauthera.io/docs/v1/clients#dynamic-client-registration).
- As an operator: the registration policy is fixed in code; a client that needs more
  is registered through the operator or the AdminService.
- As a user: nothing to do.

## Escalation

If a value the docs list as allowed is refused, open an issue with the request id, the
server version and the field. Never attach the initial or registration access token.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.