client-metadata-support

Fetch and validate OAuth client metadata documents from HTTPS URLs.

47|5|Updated Apr 25, 2026

Search Tags:#authorization #security #oauth #validation #metadata #client

Ready to run

npx skills add https://github.com/RedHatProductSecurity/prodsec-skills --skill client-metadata-support

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: client-metadata-support
Source: https://github.com/RedHatProductSecurity/prodsec-skills/tree/main/module/skills/client-metadata-support
Command: npx skills add https://github.com/RedHatProductSecurity/prodsec-skills --skill client-metadata-support

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill facilitates support for OAuth Client ID Metadata Documents in authorization servers, enabling dynamic client registration and secure validation workflows.

Core Features & Use Cases

Metadata Fetching: Retrieves client metadata documents hosted at HTTPS URLs specified as client_id.
Validation and Security: Ensures fetched documents comply with security policies such as HTTPS retrieval, matching client_id, and validating redirect URIs.
Use Case: When building or reviewing an authorization server, developers can automate the process of fetching and validating client configurations to ensure security standards are met.

Quick Start

Use the client-metadata-support skill to verify the security of a client metadata document hosted at a specific URL, ensuring it conforms to validation rules.

Frequently Asked Questions about client-metadata-support

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I validate OAuth client metadata documents in an authorization server?▼

To validate OAuth client metadata documents, you must verify HTTPS fetches, ensure the correct client_id matching, and validate redirect URIs. This process automates secure client configuration retrieval and compliance during dynamic client registration.

What is OAuth client metadata used for in dynamic client registration?▼

OAuth client metadata is used to securely retrieve and validate client configurations hosted at HTTPS URLs. It enables dynamic client registration workflows by ensuring that client metadata documents comply with required security policies.

How do I automate fetching client configurations from HTTPS URLs for OAuth?▼

You can automate fetching client configurations by treating the HTTPS URL as the client_id. The system retrieves the hosted client metadata document and automatically verifies it against security validation rules.

Does OAuth client metadata validation require HTTPS and client_id matching?▼

Yes, OAuth client metadata validation requires verifying HTTPS fetches and ensuring correct client_id matching. These security policies ensure that the retrieved client configuration is secure and compliant.

What security policies should I check when reviewing OAuth client registration?▼

When reviewing OAuth client registration, you should check that metadata documents are retrieved exclusively via HTTPS, that the client_id matches the fetch URL, and that redirect URIs are properly validated.