CIMD Validation Rules

Learn about the URL and JSON validation rules Auth0 applies to Client ID Metadata Documents (CIMD).

CIMD URL validation rules

To pass validation in Auth0, CIMD URLs must meet the following requirements:

Category	Rule	Requirement
Protocol	HTTPS Required	Must use the https:// scheme.
Host	No Localhost	localhost, 127.0.0.1, and ::1 are rejected.
	Valid Hostname	Must contain a non-empty hostname; triple-slashes (e.g., https:///) are forbidden.
Path	Path Component	Must contain a path beyond the root /.
	No Dot Segments	Must not contain . or .. (including encoded %2e) in the path.
Constraints	Length Limit	Maximum of 120 bytes.
	No Whitespace	No leading or trailing whitespace allowed.
	Format	Must be a non-empty string parseable as a URL.
Forbidden	No Credentials	No username or password allowed in the URL.
	No Fragments	Fragment identifiers (#) are not permitted.
	No Query	Query strings (?) are not permitted.
	No Port 0	Port 0 is reserved and forbidden.
Encoding	Percent-Encoding	% must be followed by exactly two hex digits.

CIMD JSON validation rules

Auth0 applies the following CIMD JSON validation rules:

• Unsupported properties: Auth0 ignores unsupported properties during mapping and reports them as warnings in the validation response.
• Inline JWKS: Providing an inline jwks object instead of a jwks_uri is not supported and will trigger an invalid_client_metadata error.
• Private keys: Any JWKS retrieved via jwks_uri that contains private key material (the d parameter) will be rejected.
• Fetch security: Both the CIMD document and the jwks_uri are subject to 5KB and 12KB size limits, respectively, and neither supports HTTP redirects.

Auth0 supports the following CIMD properties:

Property	Required	Type	Validation Rules	Auth0 Mapping
client_id	Yes	String	Must be a valid HTTPS URL that exactly matches the document’s hosted location.	external_client_id
client_name	Yes	String	Must be a non-empty string.	name
redirect_uris	Conditional	String Array	Required if grant_types includes authorization_code or implicit. Must be unique HTTPS URIs (loopback allowed for native apps).	callbacks
grant_types	Yes	String Array	Must include at least one supported type (authorization_code or refresh_token). Unsupported types trigger warnings and are filtered out.	grant_types
application_type	No	String	Only native or web are allowed. Unknown values are rejected. Defaults to web.	app_type
token_endpoint_auth_method	No	String	Supports none or private_key_jwt. Symmetric secret methods (e.g., client_secret_post) are forbidden.	token_endpoint_auth_method
jwks_uri	Conditional	String	Required if token_endpoint_auth_method is private_key_jwt. Must be an HTTPS URL sharing the same origin as the client_id.	jwks_uri
logo_uri	No	String	Must be a valid HTTP or HTTPS URL.	logo_uri
description	No	String	Free text with a maximum limit of 140 characters.	description
response_types	No	String Array	Validated for OIDC consistency but not persisted. Generates a warning if it contains code while authorization_code is missing from grant_types.	(None)