---
title: "OAuth authorization-server metadata for the ChatGPT MCP surface"
method: GET
path: "/.well-known/oauth-authorization-server/mcp/chatgpt"
---

# OAuth authorization-server metadata for the ChatGPT MCP surface

`GET /.well-known/oauth-authorization-server/mcp/chatgpt`

## Request

- Base URL: `https://charm.ing`
- URL: `https://charm.ing/.well-known/oauth-authorization-server/mcp/chatgpt`
- Auth: none declared

Returns the RFC 8414 authorization-server metadata for the `/mcp/chatgpt` surface, at the path-inserted well-known URL a client derives from an issuer carrying that path. Reached only when that surface's protected-resource document names the surface as its own authorization server, which `CHARMING__SERVER__CHATGPT_AUTH_PROXY_ADVERTISED` decides. The same switch decides whether this document is served, so the pointer and its target appear together: while it is off nothing names this URL and asking for it answers 404. Differs from the origin-wide document in `issuer`, which claims the surface, and in `authorization_endpoint`, which names the marketing-site login proxy while the switch is on. Token, registration, and JWKS endpoints stay on this origin.

## Response `200`

OAuth authorization-server discovery JSON scoped to /mcp/chatgpt.

- object: RFC 8414 authorization-server metadata (issuer, authorization_endpoint, token_endpoint, jwks_uri, …) plus the Charming `agent_auth` extension. Base schema is delegated to better-auth; `issuer` and `authorization_endpoint` are overridden.

---

[API](https://skmtc.dev/charm/apis/charming-api.md) · [All operations](https://skmtc.dev/charm/apis/charming-api/llms.txt) · [OpenAPI document](https://skmtc.dev/charm/apis/charming-api/revisions/a9d06c419b3a?raw)