{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40471,"path":"platform-security/authentication/configure-cimd-client.md","title":"Configure a CIMD client","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure a CIMD client\n\nRegister a Client ID Metadata Document \\(CIMD\\) client so that the instance accepts inbound OAuth requests from a client identified by a metadata document URL. You can fetch the client's configuration from its metadata URL or enter the details manually.\n\n## Before you begin\n\nRole required: `oauth_admin`\n\nTo fetch the configuration automatically, you need the client's CIMD metadata document URL.\n\n## About this task\n\nYou can register a CIMD client in two ways:\n\n- **Fetch the configuration from the metadata URL**\n\n The instance retrieves the client's metadata document and populates the client fields for you. Use this method when the client publishes a CIMD metadata document.\n\n- **Enter the configuration details manually**\n\n Provide the client fields yourself. Use this method when you want to enter or adjust the details by hand.\n\n\nEach CIMD client also has a metadata sync mode that controls how the instance keeps the client's configuration current:\n\n- **Live \\(Dynamic\\)**\n\n For fully trusted clients. The ServiceNow AI Platform refreshes the client configuration dynamically from the Client ID metadata. The metadata is cached and re-fetched when the cache expires \\(default 1 hour\\), not on every use.\n\n- **Static \\(Manual\\)**\n\n For pre-approved clients. The ServiceNow AI Platform uses the initial configuration captured during onboarding. No automatic updates are made afterward.\n\n\n## Procedure\n\n1. Navigate to **All** > **System OAuth** > **CIMD Clients**.\n\n2. Select **New**.\n\n3. On the **What kind of OAuth application?** page, select **Configure a Client ID Metadata Document \\(CIMD\\) client**.\n\n The **Add a CIMD OAuth Client** dialog opens.\n\n \\[Omitted image \"cimd-client-1.png\"\\] Alt text: Add a CIMD OAuth Client\n\n4. Provide the client configuration using one of the following methods:\n\n - Fetch from the metadata URL \\(recommended\\): In **CIMD Metadata URL**, enter the client's metadata document URL — for example, `https://vscode.dev/oauth/client-metadata.json` and select **Fetch Metadata**. The instance retrieves the document and populates the **Client Name**, **Redirect URIs**, **Response Types**, **Client URI**, and **Logo URL** fields.\n - Enter the details manually: Select **Enter the details instead**, and enter the client's **Name**, **Client ID** \\(the CIMD metadata document URL\\), and the remaining fields.\n5. Select the **Metadata Sync Mode**:\n\n - Live: The instance fetches the latest configuration from the Client ID metadata each time the client is used. You don't maintain the **Client Name**, **Redirect URIs**, **Response Types**, **Client URI**, or **Logo URI** values manually.\n - Static: The instance stores the configuration captured during onboarding and makes no automatic updates. Provide the **Client Name**, **Redirect URIs**, **Response Types**, **Client URI**, or **Logo URI** values, because the instance doesn't refresh them automatically.\n **Note:** The registration dialog uses spec-style labels for some of these fields — **Client ID \\(CIMD URL\\)**, **Client Name**, **Redirect URIs**, and **Logo URI** — while the saved record uses the labels in this table \\(**Client ID**, **Name**, **Redirect URL**, and **Logo URL**\\). These are the same fields.\n\n \\[Omitted image \"cimd-client-2.png\"\\] Alt text: Add a CIMD OAuth Client\n\n6. If the client uses localhost redirect URIs, select **Localhost redirection allowed**.\n\n7. Review and complete the remaining fields, using the following descriptions.\n\n **Note:**\n\n - The **Mode** column in the following table indicates whether a field applies to both metadata sync modes or only to a specific mode.\n - Fields marked **Static** are entered manually; in **Live** mode, the instance fetches those values from the CIMD endpoint during the authorization code flow.\n\n
\n\nField\n\n\n\nRequired\n\n\n\nMode\n\n\n\nNotes\n\n
\n\n**Name**\n\n\n\nYes\n\n\n\nBoth\n\n\n\nDisplay name for the client.\n\n
\n\n**Client ID**\n\n\n\nYes\n\n\n\nBoth\n\n\n\nThe HTTPS CIMD metadata URL, set automatically from the URL entered at registration. This URL is the client identifier used in the OAuth flow.\n\n
\n\n**Client URI**\n\n\n\nNo\n\n\n\nStatic\n\n\n\nClient home page.\n\n
\n\n**Redirect URL**\n\n\n\nYes\n\n\n\nStatic\n\n\n\nWhere the authorization code is returned. In Live mode, it's fetched from the CIMD endpoint during the authorization code flow. Multiple redirect URLs are supported.\n\n
\n\n**Logo URL**\n\n\n\nNo\n\n\n\nBoth\n\n\n\nLogo shown on the consent screen.\n\n
\n\n**Metadata Sync Mode**\n\n\n\nNo\n\n\n\nBoth\n\n\n\nLive \\(default\\) fetches from the CIMD endpoint. Static pins the manually entered values.\n\n
\n\n**Localhost redirection allowed**\n\n\n\nNo\n\n\n\nBoth\n\n\n\nTurn on to allow localhost redirection when the redirect URL is localhost or a loopback address.\n\n
\n\n**Active**\n\n\n\n—\n\n\n\nBoth\n\n\n\nOn by default.\n\n
\n\n**Refresh Token Lifespan**\n\n\n\nYes\n\n\n\nBoth\n\n\n\nSeconds; default `8,640,000`.\n\n
\n\n**Access Token Lifespan**\n\n\n\nYes\n\n\n\nBoth\n\n\n\nSeconds; default `1,800`.\n\n
\n\n**Response Types**\n\n\n\nNo\n\n\n\nStatic\n\n\n\nSupports code only; authorization code with PKCE only.\n\n
\n\n**Public Client**\n\n\n\n—\n\n\n\nBoth\n\n\n\nAlways on for CIMD clients \\(PKCE\\); read-only.\n\n
\n\n**Token Format**\n\n\n\nYes\n\n\n\nBoth\n\n\n\n- Opaque \\(default\\)\n- JWT\n\n\n
\n\n**Scope Restriction**\n\n\n\nYes\n\n\n\nBoth\n\n\n\n- Securely scoped \\(default\\)\n- Broadly scoped\n **Note:** For ServiceNow MCP server use cases, use Broadly Scoped.\n\n
\n\n**Cache lifespan**\n\n\n\nNo\n\n\n\nBoth\n\n\n\nMetadata cache in seconds; default `3,600`.\n\n
\n\n**Auth Scopes** \\(related list\\)\n\n\n\n—\n\n\n\nBoth\n\n\n\nScopes granted to the client. To know more about Auth Scopes, see [REST API Auth Scope](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/rest-api-auth-scope.md).\n\n
\n\n**Generic fields**\n\n
\n\n**Login URL**\n\n\n\nNo\n\n\n\nBoth\n\n\n\nOptional login URL.\n\n
\n\n**Application**\n\n\n\n—\n\n\n\nBoth\n\n\n\nGlobal \\(read-only\\).\n\n
\n\n**Accessible from**\n\n\n\n—\n\n\n\nBoth\n\n\n\nAll application scopes \\(default\\).\n\n
\n\n**Comments**\n\n\n\nNo\n\n\n\nBoth\n\n\n\nFree text.\n\n
\\[Omitted image \"cimd-client-3.png\"\\] Alt text: CIMD Registration\n\n8. Register the client:\n\n - If you fetched the metadata in the dialog, select **Create**.\n - If you entered the details on the form, select **Submit** or **Update** to complete the registration.\n\n## Result\n\nThe CIMD client is registered and appears in the **CIMD Registered Clients** list. The instance accepts inbound OAuth requests from the client, validating the request against the client's metadata each time the client initiates a flow.\n\n"}}