---
title: "RFC 8414 metadata, plus the auth.md `agent_auth` block"
method: GET
path: "/.well-known/oauth-authorization-server"
tags: ["Discovery"]
---

# RFC 8414 metadata, plus the auth.md \`agent_auth\` block

`GET /.well-known/oauth-authorization-server`

## Request

- Base URL: `https://youspot.com`
- URL: `https://youspot.com/.well-known/oauth-authorization-server`
- Auth: none required

Where the authorization, token, registration and revocation endpoints are, which grant types and PKCE methods are supported, and the one scope this server issues. An agent that reads this needs nothing else to run the OAuth flow.

## Headers

- `If-None-Match` string

## Response `200`

The metadata.

- AuthorizationServerMetadata
  - `issuer` string, uri, required
  - `authorization_endpoint` string, uri, required
  - `token_endpoint` string, uri, required
  - `registration_endpoint` string, uri
  - `revocation_endpoint` string, uri
  - `scopes_supported` string[]
  - `response_types_supported` string[]
  - `grant_types_supported` string[]
  - `code_challenge_methods_supported` string[]: S256 only. `plain` is refused.
  - `token_endpoint_auth_methods_supported` string[]
  - `service_documentation` string, uri
  - `agent_auth` object: What an agent can hold here, and how to get it. Mirrors /auth.md.

## Other responses

- `304`: The document has not changed since the ETag you sent. No body.

---

[API](https://skmtc.dev/youspot/apis/youspot-http-api.md) · [All operations](https://skmtc.dev/youspot/apis/youspot-http-api/llms.txt) · [OpenAPI document](https://skmtc.dev/youspot/apis/youspot-http-api/revisions/6615ad5d017d?raw)