diff --git a/crates/tranquil-oauth-server/src/endpoints/token/grants.rs b/crates/tranquil-oauth-server/src/endpoints/token/grants.rs
index 860ea97..ad1046c 100644
--- a/crates/tranquil-oauth-server/src/endpoints/token/grants.rs
+++ b/crates/tranquil-oauth-server/src/endpoints/token/grants.rs
@@ -8,8 +8,8 @@ use chrono::{Duration, Utc};
 use tranquil_db_traits::RefreshTokenLookup;
 use tranquil_pds::config::AuthConfig;
 use tranquil_pds::oauth::{
-    AuthFlow, ClientAuth, ClientMetadataCache, DPoPVerifier, OAuthError, RefreshToken, TokenData,
-    TokenId,
+    AuthFlow, ClientAuth, ClientMetadata, ClientMetadataCache, DPoPVerifier, OAuthError,
+    RefreshToken, TokenData, TokenId,
     db::{enforce_token_limit_for_user, lookup_refresh_token},
     verify_client_auth,
 };
@@ -22,7 +22,7 @@ const REFRESH_TOKEN_EXPIRY_DAYS_PUBLIC: i64 = 14;
 async fn verify_request_client_auth(
     expected_client_id: &tranquil_types::ClientId,
     request_auth: &RequestClientAuth,
-) -> Result<(), OAuthError> {
+) -> Result<ClientMetadata, OAuthError> {
     let request_client_id = request_auth.client_id().ok_or_else(|| {
         OAuthError::InvalidClient("client_id is required".to_string())
     })?;
@@ -63,7 +63,8 @@ async fn verify_request_client_auth(
         &client_auth,
         &token_endpoint,
     )
-    .await
+    .await?;
+    Ok(client_metadata)
 }
 
 pub async fn handle_authorization_code_grant(
@@ -104,7 +105,8 @@ pub async fn handle_authorization_code_grant(
         .require_authorized()
         .map_err(|_| OAuthError::InvalidGrant("Authorization not completed".to_string()))?;
 
-    verify_request_client_auth(&authorized.client_id, &request.client_auth).await?;
+    let client_metadata =
+        verify_request_client_auth(&authorized.client_id, &request.client_auth).await?;
     let did = authorized.did.clone();
     verify_pkce(&authorized.parameters.code_challenge, &code_verifier)?;
     let redirect_uri = redirect_uri.ok_or_else(|| {