---
title: "OAuth 2.1 authorization-server metadata (RFC 8414)"
method: GET
path: "/.well-known/oauth-authorization-server"
tags: ["OAuth"]
---

# OAuth 2.1 authorization-server metadata (RFC 8414)

`GET /.well-known/oauth-authorization-server`

## Request

- Base URL: `https://tre-app.com`
- URL: `https://tre-app.com/.well-known/oauth-authorization-server`
- Auth: none required

Published when `OAUTH_ENABLED=true`. Answers 404 while the flag is off. No Tre bearer. Advertises authorize, token and revoke endpoints, S256 PKCE, and `none` / `private_key_jwt` client auth.

## Response `200`

Success

- OAuthAuthorizationServerMetadata
  - `issuer` string, uri, required
  - `authorization_endpoint` string, uri, required
  - `token_endpoint` string, uri, required
  - `revocation_endpoint` string, uri, required
  - `response_types_supported` string[], required
  - `grant_types_supported` string[], required
  - `code_challenge_methods_supported` string[], required
  - `token_endpoint_auth_methods_supported` string[], required
  - `token_endpoint_auth_signing_alg_values_supported` string[], required: JWS algorithms accepted for private_key_jwt client assertions (ES256, RS256, PS256, EdDSA).
  - `revocation_endpoint_auth_methods_supported` string[], required
  - `revocation_endpoint_auth_signing_alg_values_supported` string[], required
  - `scopes_supported` string[], required
  - `client_id_metadata_document_supported` boolean, required
  - `authorization_response_iss_parameter_supported` boolean, required

## Other responses

- `404`: OAuth door is off (`OAUTH_ENABLED` unset or not `true`).

---

[API](https://skmtc.dev/tre-app/apis/tre-rest-api.md) · [All operations](https://skmtc.dev/tre-app/apis/tre-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tre-app/apis/tre-rest-api/revisions/26a7187a05fc?raw)