← methodology

OAuth authorization server metadata

usability.oauth-as-metadata · Usability · 3 pts · recommended

Goal

Can an agent authenticate to you?

Whether agents can discover your auth model machine-readably (OAuth metadata) and follow documented steps to credentials.

How we test

Fetched /.well-known/oauth-authorization-server (and openid-configuration fallback).

How to pass

Serve RFC 8414 metadata with PKCE (S256) and a registration_endpoint so agents can self-onboard.

Spec

https://www.rfc-editor.org/rfc/rfc8414 ↗

Verify a fix

curl -X POST /api/scan/checks \
  -H 'content-type: application/json' \
  -d '{"url": "yourdomain.com", "checkIds": ["usability.oauth-as-metadata"]}'