---
title: "Get authorization server metadata (RFC 8414)"
method: GET
path: "/.well-known/oauth-authorization-server"
tags: ["OAuth discovery"]
---

# Get authorization server metadata (RFC 8414)

`GET /.well-known/oauth-authorization-server`

## Request

- Base URL: `https://api.elaichi.ai`
- URL: `https://api.elaichi.ai/.well-known/oauth-authorization-server`
- Auth: none required

Endpoint URLs and capabilities of the MCP authorization server. Public, unauthenticated and CORS-open on the same terms as the protected-resource document. `code_challenge_methods_supported: ["S256"]` is load-bearing: it is the only machine-readable statement that PKCE is mandatory and that `plain` will be rejected. Dynamic client registration (RFC 7591) is advertised; client-id metadata documents (CIMD) deliberately are not. Cached for one hour.

## Response `200`

OK

- object
  - `issuer` string, uri
  - `authorization_endpoint` string, uri
  - `token_endpoint` string, uri
  - `registration_endpoint` string, uri
  - `revocation_endpoint` string, uri
  - `response_types_supported` string[]
  - `grant_types_supported` string[]
  - `code_challenge_methods_supported` string[]
  - `token_endpoint_auth_methods_supported` string[]
  - `revocation_endpoint_auth_methods_supported` string[]
  - `scopes_supported` string[]
  - `service_documentation` string, uri

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/elaichi/apis/elaichi-api.md) · [All operations](https://skmtc.dev/elaichi/apis/elaichi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaichi/apis/elaichi-api/revisions/b22cfb7b6d15?raw)