You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Licensed under the Apache License, Version 2.0 (the "License");
4
+
# you may not use this file except in compliance with the License.
5
+
# You may obtain a copy of the License at
6
+
#
7
+
# http://www.apache.org/licenses/LICENSE-2.0
8
+
#
9
+
# Unless required by applicable law or agreed to in writing, software
10
+
# distributed under the License is distributed on an "AS IS" BASIS,
11
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
+
# See the License for the specific language governing permissions and
13
+
# limitations under the License.
14
+
title: OAuth 2.0 Client Server Metadata
15
+
type: object
16
+
description: |-
17
+
This definition of the metadata specifies only the fields that are meaningful
18
+
in the context of the Matrix specification. All the possible values are
19
+
registered in the [OAuth Dynamic Client Registration Metadata registry](https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#client-metadata),
20
+
and normative definitions of them are available in their respective RFCs.
21
+
properties:
22
+
client_uri:
23
+
type: string
24
+
format: uri
25
+
description: |-
26
+
A URL to a valid web page that SHOULD give the user more information about
27
+
the client.
28
+
29
+
This URL MUST use the `https` scheme and SHOULD NOT require authentication
30
+
to access. It MUST NOT use a user or password in the authority component
31
+
of the URI.
32
+
33
+
The server MAY reject client registrations if this field is invalid or
34
+
missing.
35
+
36
+
This URI is a common base for all the other URIs in the metadata: those
37
+
MUST be either on the same host or on a subdomain of the host of the
38
+
`client_uri`. The port number, path and query components MAY be different.
39
+
40
+
For example, if the `client_uri` is `https://example.com/`, then one of
41
+
the `redirect_uris` can be `https://example.com/callback` or
42
+
`https://app.example.com/callback`, but not `https://app.com/callback`.
43
+
client_name:
44
+
type: string
45
+
description: |-
46
+
Human-readable name of the client to be presented to the user.
47
+
48
+
This field can be [localized](/client-server-api/#metadata-localization).
49
+
logo_uri:
50
+
type: string
51
+
format: uri
52
+
description: |-
53
+
URL that references a logo for the client.
54
+
55
+
This URL MUST use the `https` scheme.
56
+
57
+
This field can be [localized](/client-server-api/#metadata-localization).
58
+
tos_uri:
59
+
type: string
60
+
format: uri
61
+
description: |-
62
+
URL that points to a human-readable terms of service document for the
63
+
client.
64
+
65
+
This URL MUST use the `https` scheme and SHOULD NOT require authentication
66
+
to access. It MUST NOT use a user or password in the authority component
67
+
of the URI.
68
+
69
+
If this field is set, the server SHOULD show or link to this URL.
70
+
71
+
This field can be [localized](/client-server-api/#metadata-localization).
72
+
policy_uri:
73
+
type: string
74
+
format: uri
75
+
description: |-
76
+
URL that points to a human-readable policy document for the client.
77
+
78
+
This URL MUST use the `https` scheme and SHOULD NOT require authentication
79
+
to access. It MUST NOT use a user or password in the authority component
80
+
of the URI.
81
+
82
+
If this field is set, the server SHOULD show or link to this URL.
83
+
84
+
This field can be [localized](/client-server-api/#metadata-localization).
85
+
redirect_uris:
86
+
type: array
87
+
description: |-
88
+
Array of redirection URIs for use in redirect-based flows.
89
+
90
+
At least one URI is required to use the authorization code grant.
91
+
92
+
The server MUST perform [validation on redirect URIs](/client-server-api/#redirect-uri-validation).
93
+
items:
94
+
type: string
95
+
format: uri
96
+
description: A redirection URI.
97
+
response_types:
98
+
type: array
99
+
description: |-
100
+
Array of the OAuth 2.0 response types that the client may use.
101
+
102
+
This MUST include the `code` value to use the authorization code grant.
103
+
104
+
The server MUST ignore values that it does not understand.
105
+
items:
106
+
type: string
107
+
description: A response type that the client may use.
108
+
grant_types:
109
+
type: array
110
+
description: |-
111
+
Array of the OAuth 2.0 grant types that the client may use.
112
+
113
+
This MUST include:
114
+
- the `authorization_code` value to use the authorization code grant,
115
+
- the `refresh_token` value to use the refresh token grant.
116
+
117
+
The server MUST ignore values that it does not understand.
118
+
items:
119
+
type: string
120
+
description: A grant type that the client may use.
121
+
token_endpoint_auth_method:
122
+
type: string
123
+
description: |-
124
+
String indicator of the requested authentication method for the token
125
+
endpoint.
126
+
127
+
The homeserver MUST support the `none` value, as most Matrix clients are
128
+
client-side only, do not have a server component, and therefore are public
129
+
clients.
130
+
application_type:
131
+
type: string
132
+
description: |-
133
+
Kind of the application.
134
+
135
+
The homeserver MUST support the `web` and `native` values to be able to
136
+
perform [redirect URI validation](/client-server-api/#redirect-uri-validation).
0 commit comments