# Get authorization server metadata

Machine-readable OAuth 2.0 authorization server metadata (RFC 8414): endpoint URLs,
supported grant types, PKCE methods, and scopes. Agents and MCP hosts use this
document to discover the authorization and token endpoints automatically.

Endpoint: GET /.well-known/oauth-authorization-server
Version: 3.0.0-preview

## Response 200:

  - `200` (unknown)
    Authorization server metadata.

## Response 200 fields (application/json):

  - `issuer` (string, required)

  - `authorization_endpoint` (string, required)

  - `token_endpoint` (string, required)

  - `revocation_endpoint` (string)

  - `registration_endpoint` (string)

  - `client_id_metadata_document_supported` (boolean)
    Whether a `client_id` may be an HTTPS URL pointing to a client metadata document (CIMD). Clients that support the URL form only attempt it when this is `true`.

  - `authorization_response_iss_parameter_supported` (boolean)
    Every authorization response, success or error, carries `iss` equal to `issuer` (RFC 9207). Clients compare it with the recorded `issuer` before redeeming the code.

  - `response_types_supported` (array)

  - `grant_types_supported` (array)

  - `code_challenge_methods_supported` (array)

  - `token_endpoint_auth_methods_supported` (array)

  - `scopes_supported` (array)

## Response 200 headers (application/json):

  - `X-Request-Id` (string)
    Request identifier for support and log correlation.

  - `Cache-Control` (string)
    Public metadata may be cached briefly; clients should revalidate before long-lived use.
    Example: public, max-age=3600

## Response 400:

  - `400` (unknown)
    Invalid metadata request (OAuth error object).

## Response 400 fields (application/json):

  - `error` (string, required)
    OAuth error code (`invalid_request`, `invalid_grant`, `invalid_client`, ...).

  - `error_description` (string)

## Response 404:

  - `404` (unknown)
    Metadata document is not available.

## Response 429:

  - `429` (unknown)
    Too many metadata requests from this address. Discovery is cacheable — honour
`Cache-Control` instead of polling. Retry after the interval in `Retry-After`.

## Response 429 fields (application/json):

  - `error` (string, required)
    OAuth error code (`invalid_request`, `invalid_grant`, `invalid_client`, ...).

  - `error_description` (string)

## Response 429 headers (application/json):

  - `Retry-After` (integer)
    Seconds to wait before retrying.
    Example: 60

## Response 500:

  - `500` (unknown)
    Metadata document cannot be generated (OAuth error object).

## Response 500 fields (application/json):

  - `error` (string, required)
    OAuth error code (`invalid_request`, `invalid_grant`, `invalid_client`, ...).

  - `error_description` (string)

## Response 503:

  - `503` (unknown)
    Authorization metadata dependency is unavailable (OAuth error object).

## Response 503 fields (application/json):

  - `error` (string, required)
    OAuth error code (`invalid_request`, `invalid_grant`, `invalid_client`, ...).

  - `error_description` (string)