# OAuth 2.0 Authorization Server Metadata (RFC 8414)

`GET /.well-known/oauth-authorization-server`

Returns the OAuth 2.0 authorization-server metadata (RFC 8414). Shares
the metadata schema with the OpenID discovery document; OIDC-only fields
may be present. Cacheable (`Cache-Control: public, max-age=300`).

## Authorization

None: this endpoint does not take API credentials.

Responses may be cached for 5 minutes.

## Responses

### 200 OK

Authorization server metadata.

Content type: `application/json`

OAuth 2.0 Authorization Server Metadata (RFC 8414) unified with OpenID Provider Metadata (OIDC Discovery 1.0). Serves both discovery documents.

- `issuer` (string (uri), required): The issuer identifier (an https URL, no query/fragment/trailing slash). Example: `"https://auth.example.com"`.
- `authorization_endpoint` (string (uri), required): Example: `"https://auth.example.com/authorize"`.
- `token_endpoint` (string (uri), required): Example: `"https://auth.example.com/token"`.
- `jwks_uri` (string (uri), required): Example: `"https://auth.example.com/.well-known/jwks.json"`.
- `response_types_supported` (array of strings, required): Example: `["code"]`.
- `subject_types_supported` (array of strings, required): Example: `["public"]`.
- `id_token_signing_alg_values_supported` (array of strings, required): Example: `["ES256"]`.
- `userinfo_endpoint` (string (uri), optional): Example: `"https://auth.example.com/userinfo"`.
- `registration_endpoint` (string (uri), optional): Example: `"https://auth.example.com/register"`.
- `introspection_endpoint` (string (uri), optional): Example: `"https://auth.example.com/introspect"`.
- `revocation_endpoint` (string (uri), optional): Example: `"https://auth.example.com/revoke"`.
- `device_authorization_endpoint` (string (uri), optional): Example: `"https://auth.example.com/device_authorization"`.
- `pushed_authorization_request_endpoint` (string (uri), optional): Example: `"https://auth.example.com/par"`.
- `end_session_endpoint` (string (uri), optional): Example: `"https://auth.example.com/end_session"`.
- `check_session_iframe` (string (uri), optional): Example: `"https://auth.example.com/check_session_iframe"`.
- `scopes_supported` (array of strings, optional): A JSON array of strings.
- `response_modes_supported` (array of strings, optional): A JSON array of strings.
- `grant_types_supported` (array of strings, optional): A JSON array of strings.
- `userinfo_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `request_object_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `token_endpoint_auth_methods_supported` (array of strings, optional): A JSON array of strings.
- `token_endpoint_auth_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `revocation_endpoint_auth_methods_supported` (array of strings, optional): A JSON array of strings.
- `revocation_endpoint_auth_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `introspection_endpoint_auth_methods_supported` (array of strings, optional): A JSON array of strings.
- `introspection_endpoint_auth_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `code_challenge_methods_supported` (array of strings, optional): A JSON array of strings.
- `dpop_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `authorization_details_types_supported` (array of strings, optional): A JSON array of strings.
- `claims_supported` (array of strings, optional): A JSON array of strings.
- `ui_locales_supported` (array of strings, optional): A JSON array of strings.
- `acr_values_supported` (array of strings, optional): A JSON array of strings.
- `claims_parameter_supported` (boolean, optional): Example: `true`.
- `request_parameter_supported` (boolean, optional): Example: `false`.
- `request_uri_parameter_supported` (boolean, optional): Example: `true`.
- `require_request_uri_registration` (boolean, optional): Example: `true`.
- `require_pushed_authorization_requests` (boolean, optional): Example: `false`.
- `authorization_response_iss_parameter_supported` (boolean, optional): Example: `true`.
- `tls_client_certificate_bound_access_tokens` (boolean, optional): Example: `false`.
- `backchannel_logout_supported` (boolean, optional): Example: `false`.
- `backchannel_logout_session_supported` (boolean, optional): Example: `false`.
- `frontchannel_logout_supported` (boolean, optional): Example: `false`.
- `frontchannel_logout_session_supported` (boolean, optional): Example: `false`.
- `service_documentation` (string (uri), optional)
- `op_policy_uri` (string (uri), optional)
- `op_tos_uri` (string (uri), optional)

## Example request

```bash
curl 'https://auth.example.com/.well-known/oauth-authorization-server'
```

## Example response (200)

```json
{
  "issuer": "https://auth.example.com",
  "authorization_endpoint": "https://auth.example.com/authorize",
  "token_endpoint": "https://auth.example.com/token",
  "userinfo_endpoint": "https://auth.example.com/userinfo",
  "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
  "registration_endpoint": "https://auth.example.com/register",
  "introspection_endpoint": "https://auth.example.com/introspect",
  "revocation_endpoint": "https://auth.example.com/revoke",
  "device_authorization_endpoint": "https://auth.example.com/device_authorization",
  "pushed_authorization_request_endpoint": "https://auth.example.com/par",
  "end_session_endpoint": "https://auth.example.com/end_session",
  "check_session_iframe": "https://auth.example.com/check_session_iframe",
  "response_types_supported": [
    "code"
  ],
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "ES256"
  ],
  "claims_parameter_supported": true,
  "request_parameter_supported": false,
  "request_uri_parameter_supported": true,
  "require_request_uri_registration": true,
  "require_pushed_authorization_requests": false,
  "authorization_response_iss_parameter_supported": true,
  "tls_client_certificate_bound_access_tokens": false,
  "backchannel_logout_supported": false,
  "backchannel_logout_session_supported": false,
  "frontchannel_logout_supported": false,
  "frontchannel_logout_session_supported": false
}
```