OAuth Client Metadata Validator

Cross-check registration, authorization-server, and OIDC metadata without fetching discovery or registration endpoints.

Paste public metadata or fictional examples. This validator never fetches issuer URLs or registration endpoints.

Client metadataRFC 7591 registration

{
  "client_id": "client-100",
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": [
    "code"
  ],
  "redirect_uris": [
    "https://app.example.test/callback"
  ],
  "token_endpoint_auth_method": "none"
}

Server metadataRFC 8414

{
  "issuer": "https://issuer.example.test",
  "grant_types_supported": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types_supported": [
    "code"
  ],
  "token_endpoint_auth_methods_supported": [
    "none",
    "private_key_jwt"
  ]
}

OIDC metadataOptional discovery JSON

{
  "issuer": "https://issuer.example.test",
  "id_token_signing_alg_values_supported": [
    "RS256"
  ]
}

Compatibility reviewReviewable

{
  "client": {
    "client_id": "client-100",
    "grant_types": [
      "authorization_code",
      "refresh_token"
    ],
    "response_types": [
      "code"
    ],
    "redirect_uris": [
      "https://app.example.test/callback"
    ],
    "token_endpoint_auth_method": "none"
  },
  "server": {
    "issuer": "https://issuer.example.test",
    "grant_types_supported": [
      "authorization_code",
      "refresh_token"
    ],
    "response_types_supported": [
      "code"
    ],
    "token_endpoint_auth_methods_supported": [
      "none",
      "private_key_jwt"
    ]
  },
  "oidc": {
    "issuer": "https://issuer.example.test",
    "id_token_signing_alg_values_supported": [
      "RS256"
    ]
  },
  "compatibility": "reviewable"
}