diff --git a/src/possum/oauth/metadata.gleam b/src/possum/oauth/metadata.gleam
index 0b24c4a..07c1c39 100644
--- a/src/possum/oauth/metadata.gleam
+++ b/src/possum/oauth/metadata.gleam
@@ -47,6 +47,8 @@ pub opaque type Builder {
     jwks: List(String),
     /// URL to client logo. Only https: URIs are allowed.
     logo_uri: option.Option(uri.Uri),
+    /// HTTP URL to human-readable privacy policy for the client
+    policy_uri: option.Option(uri.Uri),
     /// Any scope values which might be requested by this client are declared here.
     /// The atproto scope is required.
     scope: List(String),
@@ -58,6 +60,8 @@ pub opaque type Builder {
     token_endpoint_auth_method: option.Option(String),
     /// Confidential client set this to ES256
     token_endpoint_auth_signing_alg: option.Option(String),
+    /// HTTP URL to human-readable terms of service ("ToS") for the client
+    tos_uri: option.Option(uri.Uri),
   )
 }
 
@@ -71,14 +75,20 @@ pub fn new() -> Builder {
     grant_types: ["authorization_code"],
     jwks: [],
     logo_uri: option.None,
+    policy_uri: option.None,
     redirect_uris: [],
     response_types: ["code"],
     scope: ["atproto"],
     token_endpoint_auth_method: option.None,
     token_endpoint_auth_signing_alg: option.None,
+    tos_uri: option.None,
   )
 }
 
+pub fn application_type(self: Builder, value: String) -> Builder {
+  Builder(..self, application_type: value)
+}
+
 pub fn client_id(self: Builder, value: uri.Uri) -> Builder {
   Builder(..self, client_id: value)
 }
@@ -91,42 +101,49 @@ pub fn client_name(self: Builder, value: String) -> Builder {
   Builder(..self, client_name: option.Some(value))
 }
 
-pub fn logo_uri(self: Builder, value: uri.Uri) -> Builder {
-  Builder(..self, logo_uri: option.Some(value))
-}
-
-pub fn application_type(self: Builder, value: String) -> Builder {
-  Builder(..self, application_type: value)
+pub fn dpop_bound_access_tokens(self: Builder, value: Bool) -> Builder {
+  Builder(..self, dpop_bound_access_tokens: value)
 }
 
 pub fn grant_types(self: Builder, value: List(String)) -> Builder {
   Builder(..self, grant_types: value)
 }
 
-pub fn scope(self: Builder, value: List(String)) -> Builder {
-  Builder(..self, scope: value)
+pub fn jwks(self: Builder, value: List(String)) -> Builder {
+  Builder(..self, jwks: value)
 }
 
-pub fn response_types(self: Builder, value: List(String)) -> Builder {
-  Builder(..self, response_types: value)
+pub fn logo_uri(self: Builder, value: uri.Uri) -> Builder {
+  Builder(..self, logo_uri: option.Some(value))
+}
+
+pub fn policy_uri(self: Builder, value: uri.Uri) -> Builder {
+  Builder(..self, policy_uri: option.Some(value))
 }
 
 pub fn redirect_uris(self: Builder, value: List(uri.Uri)) -> Builder {
   Builder(..self, redirect_uris: value)
 }
 
-pub fn dpop_bound_access_tokens(self: Builder, value: Bool) -> Builder {
-  Builder(..self, dpop_bound_access_tokens: value)
+pub fn response_types(self: Builder, value: List(String)) -> Builder {
+  Builder(..self, response_types: value)
+}
+
+pub fn scope(self: Builder, value: List(String)) -> Builder {
+  Builder(..self, scope: value)
 }
 
-pub fn auth_method(self: Builder, value: String) -> Builder {
+pub fn token_endpoint_auth_method(self: Builder, value: String) -> Builder {
   Builder(..self, token_endpoint_auth_method: option.Some(value))
 }
 
-pub fn auth_signing_algorithm(self: Builder, value: String) -> Builder {
+pub fn token_endpoint_auth_signing_algorithm(
+  self: Builder,
+  value: String,
+) -> Builder {
   Builder(..self, token_endpoint_auth_signing_alg: option.Some(value))
 }
 
-pub fn jwks(self: Builder, value: List(String)) -> Builder {
-  Builder(..self, jwks: value)
+pub fn tos_uri(self: Builder, value: uri.Uri) -> Builder {
+  Builder(..self, tos_uri: option.Some(value))
 }