OAuth

Authorization server metadata

RFC 8414 metadata. An MCP client that receives a 401 from /mcp reads the resource_metadata pointer, follows it to this document, registers itself and starts a PKCE flow — with no configuration from the customer beyond the server URL.

Note token_endpoint_auth_methods_supported: [none] and code_challenge_methods_supported: [S256]. Both are deliberate: every client here is a public client, so a client secret we issued would be a secret embedded in a distributed application, and OAuth 2.1 removes plain PKCE.

get/.well-known/oauth-authorization-server

Request

  • Base URL: https://scanduro.com
  • URL: https://scanduro.com/.well-known/oauth-authorization-server
  • Auth: HTTP bearer

Response

Endpoints, grants and scopes this server supports.

issuerstring uri required
authorization_endpointstring uri required
token_endpointstring uri required
registration_endpointstring uri
revocation_endpointstring uri
scopes_supportedApiScope[]
response_types_supportedstring[]
grant_types_supportedstring[]
token_endpoint_auth_methods_supportedstring[]
code_challenge_methods_supportedstring[]

Changes

No recorded changes to this operation across all 1 revision of this API.