From 78b5b5209addd27dc3a375c2cd3f6a3d4446867a Mon Sep 17 00:00:00 2001 From: jh-block Date: Wed, 15 Apr 2026 17:53:25 +0200 Subject: [PATCH] feat: support Client ID Metadata Document (CIMD) for OAuth (#8550) --- crates/goose/src/oauth/mod.rs | 10 ++++++++-- documentation/static/oauth/client-metadata.json | 12 ++++++++++++ 2 files changed, 20 insertions(+), 2 deletions(-) create mode 100644 documentation/static/oauth/client-metadata.json diff --git a/crates/goose/src/oauth/mod.rs b/crates/goose/src/oauth/mod.rs index 84efa33c73..82a81f7dde 100644 --- a/crates/goose/src/oauth/mod.rs +++ b/crates/goose/src/oauth/mod.rs @@ -17,6 +17,7 @@ use tracing::warn; use crate::oauth::persist::GooseCredentialStore; const CALLBACK_TEMPLATE: &str = include_str!("oauth_callback.html"); +const CLIENT_METADATA_URL: &str = "https://goose-docs.ai/oauth/client-metadata.json"; #[derive(Clone)] struct AppState { @@ -79,9 +80,14 @@ pub async fn oauth_flow( let mut oauth_state = OAuthState::new(mcp_server_url, None).await?; - let redirect_uri = format!("http://localhost:{}/oauth_callback", used_addr.port()); + let redirect_uri = format!("http://127.0.0.1:{}/oauth_callback", used_addr.port()); oauth_state - .start_authorization(&[], redirect_uri.as_str(), Some("goose")) + .start_authorization_with_metadata_url( + &[], + redirect_uri.as_str(), + Some("goose"), + Some(CLIENT_METADATA_URL), + ) .await?; let authorization_url = oauth_state.get_authorization_url().await?; diff --git a/documentation/static/oauth/client-metadata.json b/documentation/static/oauth/client-metadata.json new file mode 100644 index 0000000000..ab62fb8918 --- /dev/null +++ b/documentation/static/oauth/client-metadata.json @@ -0,0 +1,12 @@ +{ + "client_id": "https://goose-docs.ai/oauth/client-metadata.json", + "client_name": "goose", + "redirect_uris": [ + "http://127.0.0.1/oauth_callback", + "http://[::1]/oauth_callback" + ], + "grant_types": ["authorization_code", "refresh_token"], + "response_types": ["code"], + "token_endpoint_auth_method": "none", + "code_challenge_methods_supported": ["S256"] +}