OIDC metadata is the set of structured client details used when an application registers with an OpenID Connect provider. It commonly includes the client name, redirect URIs, logout URIs, grant types, token settings, and other application-specific policy data. In practice, this metadata tells the identity system how the client is allowed to authenticate and where responses may be sent.
It matters because weak validation of OIDC metadata can create serious security problems. If an attacker can register a client with a malicious redirect URI, steal or intercept tokens, or set unsafe application options, they may gain access to accounts or internal data. Defenders should treat registration data as untrusted input: enforce exact redirect URI matching, restrict self-service registration, and review metadata changes with the same care as code or configuration. In identity platforms, metadata is not just setup information; it is part of the trust boundary.