---
title: "Authorization server metadata"
method: GET
path: "/.well-known/oauth-authorization-server"
tags: ["OAuth"]
---

# Authorization server metadata

`GET /.well-known/oauth-authorization-server`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/.well-known/oauth-authorization-server`
- Auth: HTTP bearer

RFC 8414 metadata. An MCP client that receives a `401` from `/mcp` reads the
`resource_metadata` pointer, follows it to this document, registers itself and starts a PKCE
flow — with no configuration from the customer beyond the server URL.

Note `token_endpoint_auth_methods_supported: [none]` and
`code_challenge_methods_supported: [S256]`. Both are deliberate: every client here is a
public client, so a client secret we issued would be a secret embedded in a distributed
application, and OAuth 2.1 removes `plain` PKCE.

## Response `200`

Endpoints, grants and scopes this server supports.

- object
  - `issuer` string, uri, required
  - `authorization_endpoint` string, uri, required
  - `token_endpoint` string, uri, required
  - `registration_endpoint` string, uri
  - `revocation_endpoint` string, uri
  - `scopes_supported` ApiScope[]
  - `response_types_supported` string[]
  - `grant_types_supported` string[]
  - `token_endpoint_auth_methods_supported` string[]
  - `code_challenge_methods_supported` string[]

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)