CIMD Validation Rules

CIMD URL validation rules

To pass validation in Auth0, CIMD URLs must meet the following requirements:

Category	Rule	Requirement
Protocol	HTTPS Required	Must use the `https://` scheme.
Host	No Localhost	`localhost`, `127.0.0.1`, and `::1` are rejected.
	Valid Hostname	Must contain a non-empty hostname; triple-slashes (e.g., `https:///`) are forbidden.
Path	Path Component	Must contain a path beyond the root `/`.
	No Dot Segments	Must not contain `.` or `..` (including encoded `%2e`) in the path.
Constraints	Length Limit	Maximum of 120 bytes.
	No Whitespace	No leading or trailing whitespace allowed.
	Format	Must be a non-empty string parseable as a URL.
Forbidden	No Credentials	No username or password allowed in the URL.
	No Fragments	Fragment identifiers (`#`) are not permitted.
	No Query	Query strings (`?`) are not permitted.
	No Port 0	Port 0 is reserved and forbidden.
Encoding	Percent-Encoding	`%` must be followed by exactly two hex digits.

Auth0 applies the following CIMD JSON validation rules:

Unsupported properties: Auth0 ignores unsupported properties during mapping and reports them as warnings in the validation response.
Inline JWKS: Providing an inline jwks object instead of a jwks_uri is not supported and will trigger an invalid_client_metadata error.
Private keys: Any JWKS retrieved via jwks_uri that contains private key material (the d parameter) will be rejected.
Fetch security: Both the CIMD document and the jwks_uri are subject to 5KB and 12KB size limits, respectively, and neither supports HTTP redirects.

Auth0 supports the following CIMD properties:

Property	Required	Type	Validation Rules	Auth0 Mapping
`client_id`	Yes	String	Must be a valid HTTPS URL that exactly matches the document’s hosted location.	`external_client_id`
`client_name`	Yes	String	Must be a non-empty string.	`name`
`redirect_uris`	Conditional	String Array	Required if `grant_types` includes `authorization_code` or `implicit`. Must be unique HTTPS URIs (loopback allowed for native apps).	`callbacks`
`grant_types`	Yes	String Array	Must include at least one supported type (`authorization_code` or `refresh_token`). Unsupported types trigger warnings and are filtered out.	`grant_types`
`application_type`	No	String	Only `native` or `web` are allowed. Unknown values are rejected. Defaults to `web`.	`app_type`
`token_endpoint_auth_method`	No	String	Supports `none` or `private_key_jwt`. Symmetric secret methods (e.g., `client_secret_post`) are forbidden.	`token_endpoint_auth_method`
`jwks_uri`	Conditional	String	Required if `token_endpoint_auth_method` is `private_key_jwt`. Must be an HTTPS URL sharing the same origin as the `client_id`.	`jwks_uri`
`logo_uri`	No	String	Must be a valid HTTP or HTTPS URL.	`logo_uri`
`description`	No	String	Free text with a maximum limit of 140 characters.	`description`
`response_types`	No	String Array	Validated for OIDC consistency but not persisted. Generates a warning if it contains `code` while `authorization_code` is missing from `grant_types`.	(None)