Discover OAuth and DCR endpoints

GET /.well-known/oauth-authorization-server

Discover the canonical issuer and endpoints for the deployed environment. Public REST grants use issuer as resource; MCP grants use issuer/mcp. CIMD client IDs must be public HTTPS metadata URLs. Registration is anonymous; device access requires user consent.

Required scope

Not required

Returns

200

Authorization server metadata.

Fields

issuerstringRequired

format: "uri"

authorization_endpointstringRequired

format: "uri"

token_endpointstringRequired

format: "uri"

registration_endpointstring

Advertised when new anonymous registration is enabled; omitted when disabled.

format: "uri"

revocation_endpointstringRequired

format: "uri"

jwks_uristring

format: "uri"

scopes_supportedarray<string>Required

code_challenge_methods_supportedarray<string>

token_endpoint_auth_methods_supportedarray<string>

client_id_metadata_document_supportedboolean

authorization_response_iss_parameter_supportedboolean