Draft -00

Copy of previous individual draft as an adopted draft

Draft -03

• Prohibit all forms of symmetric client authentication, not just client secret
• Added recommendations for development when clients are not on the web
• Added reference to HTTP Caching RFC9111
• Added security considerations around domain trust and changes in client keys
• Updated references

Draft -02

• Added security consideration around displaying logos to end users
• Changed query string parameters in Client ID Metadata Document URLs to "SHOULD NOT", since this encourages bad security practices (e.g., minting documents based on query string parameters)
• Added prohibition on the client_secret_expires_at property, as it is not relevant for Client ID Metadata Documents.
• Added security consideration for development use-cases.

Draft -01

• Added recommendation of max metadata document size
• Changed metadata property reference to IANA registry instead of Dynamic Client Registration

Draft -00

Initial publication