---
title: "OAuth/MCP discovery metadata (delegated to better-auth)"
method: GET
path: "/.well-known/oauth-authorization-server"
---

# OAuth/MCP discovery metadata (delegated to better-auth)

`GET /.well-known/oauth-authorization-server`

## Request

- Base URL: `https://charm.ing`
- URL: `https://charm.ing/.well-known/oauth-authorization-server`
- Auth: none declared

Returns the RFC 8414 authorization-server metadata document for the Charming auth surface. Consumed by MCP clients during the OAuth handshake. The base payload shape is owned by better-auth; Charming splices a WorkOS-style `agent_auth` extension block carrying `register_uri` (`/api/pair/start`), `claim_uri` (`/app/{id}/claim`), `revocation_uri` (`/api/token/{id}`), `skill` (`https://charm.ing/docs/technical-reference/authentication.md`), `identity_types_supported` (`["anonymous"]`), and an `anonymous` sibling block with `credential_types_supported` (`["api_key"]`).

## Response `200`

OAuth authorization-server discovery JSON.

- object: RFC 8414 authorization-server metadata (issuer, authorization_endpoint, token_endpoint, jwks_uri, …) plus the Charming `agent_auth` extension. Base schema is delegated to better-auth.

---

[API](https://skmtc.dev/charm/apis/charming-api.md) · [All operations](https://skmtc.dev/charm/apis/charming-api/llms.txt) · [OpenAPI document](https://skmtc.dev/charm/apis/charming-api/revisions/a9d06c419b3a?raw)