curie-oauth-client-metadata

OAuth Client ID Metadata Document

This repository exists to serve one static file: mcp-oauth-client-metadata.json.

It is an OAuth Client ID Metadata Document. Rather than registering a client and receiving an ID, the client’s client_id is the HTTPS URL of this document, and the authorization server fetches it to learn who the client is. The client_id field below is therefore self-referential: it must equal this file’s own public URL.

It is used to authenticate CurieOS against Luma’s MCP server (https://mcp.luma.com), which supports this scheme and deliberately does not support dynamic client registration.

Do not break this

• The file must stay publicly readable, with no authentication. Luma re-fetches it on every access-token refresh. If it 404s or requires login, the Luma webinar approval automation stops being able to authenticate.
• The URL must not change. It is the client’s identity. Renaming the repo, the file, or the GitHub account invalidates the existing refresh token and forces the OAuth consent flow to be redone.
• It contains no secrets. Client metadata documents are public by design; security comes from PKCE, not from the document being hidden.