---
title: "Get OAuth authorization server metadata"
method: GET
path: "/.well-known/oauth-authorization-server"
tags: ["Public"]
---

# Get OAuth authorization server metadata

`GET /.well-known/oauth-authorization-server`

## Request

- Base URL: `https://api.proof.holdings`
- URL: `https://api.proof.holdings/.well-known/oauth-authorization-server`
- Auth: none declared

RFC 8414 authorization server metadata for the MCP OAuth ceremony. Served at the issuer root, beside the JWKS, because the standard requires it there.

## Response `200`

Authorization server metadata

- OAuthAuthorizationServerMetadata
  - `issuer` string, uri, required
  - `authorization_endpoint` string, uri, required
  - `token_endpoint` string, uri, required
  - `registration_endpoint` string, uri, required: RFC 7591 dynamic client registration. Open by measurement, not by preference: without this field every client built on the shared MCP SDK refuses the server outright.
  - `revocation_endpoint` string, uri, required
  - `response_types_supported` string[], required
  - `grant_types_supported` string[], required
  - `code_challenge_methods_supported` string[], required
  - `token_endpoint_auth_methods_supported` string[], required
  - `scopes_supported` string[], required: The API-key scope vocabulary (an issued access token IS an API key) minus the scopes this surface never issues: the auth:* family, billing:write and billing:*.
  - `service_documentation` string, uri, required

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/6b8d61ee354f?raw)