---
title: "Get the OAuth 2.0 authorisation server metadata."
method: GET
path: "/_matrix/client/v1/auth_metadata"
tags: ["Session management"]
---

# Get the OAuth 2.0 authorisation server metadata.

`GET /_matrix/client/v1/auth_metadata`

## Request

- Base URL: `https://matrix.org`
- URL: `https://matrix.org/_matrix/client/v1/auth_metadata`
- Auth: none declared
- TypeScript: <https://skmtc.dev/matrix/apis/matrix-client-server-api/docs/_matrix/client/v1/auth_metadata/get.ts> (a function with typed inputs; its response is checked against the schema)

Gets the OAuth 2.0 authorisation server metadata, as defined in
[RFC 8414](https://datatracker.ietf.org/doc/html/rfc8414), including the
endpoint URLs and the supported parameters that can be used by the
clients.

This endpoint definition includes only the fields that are meaningful in
the context of the Matrix specification. The full list of possible
fields is available in the [OAuth Authorisation Server Metadata
registry](https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#authorization-server-metadata),
and normative definitions of them are available in their respective
RFCs.

**NOTE:** 
The authorisation server metadata is relatively large and may change
over time. Clients should:

- Cache the metadata appropriately based on HTTP caching headers
- Refetch the metadata if it is stale

## Response `200`

The OAuth 2.0 authorisation server metadata.

- object
  - `account_management_actions_supported` string[]: List of actions that the account management URL supports. This is an extension [defined in this specification](https://spec.matrix.org/v1.19/client-server-api/#oauth-20-account-management).
  - `account_management_uri` string, uri: The URL where the user is able to access the account management capabilities of the homeserver. This is an extension [defined in this specification](https://spec.matrix.org/v1.19/client-server-api/#oauth-20-account-management).
  - `authorization_endpoint` string, uri, required: URL of the authorisation endpoint, necessary to use the authorisation code grant.
  - `code_challenge_methods_supported` string[], required: List of OAuth 2.0 Proof Key for Code Exchange (PKCE) code challenge methods that the server supports at the authorisation endpoint. This array MUST contain at least the `S256` value, for improved security in the authorisation code grant.
  - `device_authorization_endpoint` string, uri: URL of the device authorisation endpoint, as defined in [RFC 8628](https://datatracker.ietf.org/doc/html/rfc8628), necessary to use the [device authorisation grant](https://spec.matrix.org/v1.19/client-server-api/#device-authorisation-grant).
  - `grant_types_supported` string[], required: List of OAuth 2.0 grant type strings that the server supports at the token endpoint. This array MUST contain at least the `authorization_code` and `refresh_token` values, for clients to be able to use the authorisation code grant and refresh token grant, respectively. **[Added in `v1.18`]** It MAY also contain `urn:ietf:params:oauth:grant-type:device_code` to indicate support for the [device authorisation grant](https://spec.matrix.org/v1.19/client-server-api/#device-authorisation-grant).
  - `issuer` string, uri, required: The authorisation server's issuer identifier, which is a URL that uses the `https` scheme and has no query or fragment components. This is not used in the context of the Matrix specification, but is required by [RFC 8414](https://datatracker.ietf.org/doc/html/rfc8414).
  - `prompt_values_supported` string[]: List of OpenID Connect prompt values that the server supports at the authorisation endpoint. Only the `create` value defined in [Initiating User Registration via OpenID Connect](https://openid.net/specs/openid-connect-prompt-create-1_0.html) is supported, for a client to signal to the server that the user desires to register a new account.
  - `registration_endpoint` string, uri, required: URL of the client registration endpoint, necessary to perform dynamic registration of a client.
  - `response_modes_supported` string[], required: List of OAuth 2.0 response mode strings that the server supports at the authorisation endpoint. This array MUST contain at least the `query` and `fragment` values, for improved security in the authorisation code grant.
  - `response_types_supported` string[], required: List of OAuth 2.0 response type strings that the server supports at the authorisation endpoint. This array MUST contain at least the `code` value, for clients to be able to use the authorisation code grant.
  - `revocation_endpoint` string, uri, required: URL of the revocation endpoint, necessary to log out a client by invalidating its access and refresh tokens.
  - `token_endpoint` string, uri, required: URL of the token endpoint, used by the grants.

## Other responses

- `404`: With `M_UNRECOGNIZED`: the homeserver does not support the OAuth 2.0 API. (See [Authentication API discovery](https://spec.matrix.org/v1.19/client-server-api/#authentication-api-discovery).)

---

[API](https://skmtc.dev/matrix/apis/matrix-client-server-api.md) - [All operations](https://skmtc.dev/matrix/apis/matrix-client-server-api/llms.txt) - [OpenAPI document](https://skmtc.dev/matrix/apis/matrix-client-server-api/revisions/c7fe4072c681?raw)