> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CIMD Validation Rules

> Learn about the URL and JSON validation rules Auth0 applies to Client ID Metadata Documents (CIMD).

> [!WARNING]
>
> **The Dynamic CIMD Registration feature is in .**

## CIMD URL validation rules

To pass validation in Auth0, CIMD URLs must meet the following requirements:

| Category | Rule | Requirement |
| - | - | - |
| **Protocol** | HTTPS Required | Must use the `https://` scheme. |
| **Host** | No Localhost | `localhost`, `127.0.0.1`, and `::1` are rejected. |
| | Valid Hostname | Must contain a non-empty hostname; triple-slashes (e.g., `https:///`) are forbidden. |
| **Path** | Path Component | Must contain a path beyond the root `/`. |
| | No Dot Segments | Must not contain `.` or `..` (including encoded `%2e`) in the path. |
| **Constraints** | Length Limit | Maximum of 120 bytes. |
| | No Whitespace | No leading or trailing whitespace allowed. |
| | Format | Must be a non-empty string parseable as a URL. |
| **Forbidden** | No Credentials | No username or password allowed in the URL. |
| | No Fragments | Fragment identifiers (`#`) are not permitted. |
| | No Query | Query strings (`?`) are not permitted. |
| | No Port 0 | Port 0 is reserved and forbidden. |
| **Encoding** | Percent-Encoding | `%` must be followed by exactly two hex digits. |

## CIMD JSON validation rules

Auth0 applies the following CIMD JSON validation rules:

* **Unsupported properties**: Auth0 ignores unsupported properties during mapping and reports them as warnings in the validation response.
* **Inline JWKS**: Providing an inline `jwks` object instead of a `jwks_uri` is not supported and will trigger an `invalid_client_metadata` error.
* **Private keys**: Any JWKS retrieved via `jwks_uri` that contains private key material (the `d` parameter) will be rejected.
* **Fetch security**: Both the CIMD document and the `jwks_uri` are subject to 5KB and 12KB size limits, respectively, and neither supports HTTP redirects.

Auth0 supports the following CIMD properties:

| Property | Required | Type | Validation Rules | Auth0 Mapping |
| - | - | - | - | - |
| `client_id` | Yes | String | Must be a valid HTTPS URL that exactly matches the document's hosted location. | `external_client_id` |
| `client_name` | Yes | String | Must be a non-empty string. | `name` |
| `redirect_uris` | Conditional | String Array | Required if `grant_types` includes `authorization_code` or `implicit`. Must be unique HTTPS URIs (loopback allowed for native apps). | `callbacks` |
| `grant_types` | Yes | String Array | Must include at least one supported type (`authorization_code` or `refresh_token`). Unsupported types trigger warnings and are filtered out. | `grant_types` |
| `application_type` | No | String | Only `native` or `web` are allowed. Unknown values are rejected. Defaults to `web`. | `app_type` |
| `token_endpoint_auth_method` | No | String | Supports `none` or `private_key_jwt`. Symmetric secret methods (e.g., `client_secret_post`) are forbidden. | `token_endpoint_auth_method` |
| `jwks_uri` | Conditional | String | Required if `token_endpoint_auth_method` is `private_key_jwt`. Must be an HTTPS URL sharing the same origin as the `client_id`. | `jwks_uri` |
| `logo_uri` | No | String | Must be a valid HTTP or HTTPS URL. | `logo_uri` |
| `description` | No | String | Free text with a maximum limit of 140 characters. | `description` |
| `response_types` | No | String Array | Validated for OIDC consistency but not persisted. Generates a warning if it contains `code` while `authorization_code` is missing from `grant_types`. | (None) |