---
title: "App MCP authorization-server metadata"
method: GET
path: "/_run402/.well-known/openid-configuration"
tags: ["Stable Hosts"]
---

# App MCP authorization-server metadata

`GET /_run402/.well-known/openid-configuration`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/_run402/.well-known/openid-configuration`
- Auth: none required

Authorization-server metadata (RFC 8414) for this host's app MCP endpoint. `issuer` is exactly `https://<host>/_run402`; served at the three discovery URLs MCP clients try. The app is also an OpenID provider for its own users: `scopes_supported` adds `openid`, `email`, `profile`, with `jwks_uri` (`/_run402/jwks.json`) and `id_token_signing_alg_values_supported: ["ES256"]`. On a `*.run402.com` host it answers 404 naming the `*.run402.app` MCP URL. Not served from api.run402.com.

## Response `200`

Metadata.

- object

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)