Publish OAuth server settings

If you run an OAuth authorisation server, publish its details at /.well-known/oauth-authorization-server.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Serve the details as JSON, in the format RFC 8414 sets out.

Example

{
  "issuer": "https://example.com",
  "authorization_endpoint": "https://example.com/oauth/authorize",
  "token_endpoint": "https://example.com/oauth/token",
  "response_types_supported": ["code"],
  "code_challenge_methods_supported": ["S256"]
}

How to check

OAuth clients find the endpoints.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/standard-addresses/oauth-authorization-server.