oauth.net
Authorization Server Metadata
Authorization Server Metadata (also called OAuth Discovery) defines a standard JSON document that clients can fetch to automatically discover an OAuth server's endpoints, supported grant types, scopes, and client authentication methods โ without any manual configuration.
When to use this
Publish a metadata document if you operate an authorization server โ it lets clients configure themselves automatically instead of requiring hardcoded endpoint URLs. Client libraries that support discovery can be pointed at just the issuer URL and figure out the rest. OpenID Connect servers publish a compatible document at
/.well-known/openid-configuration; OAuth-only servers use /.well-known/oauth-authorization-server.
The metadata document is a JSON object at a well-known URL derived from the issuer identifier. It includes the issuer, authorization_endpoint, token_endpoint, supported grant_types_supported, scopes_supported, token_endpoint_auth_methods_supported, and many optional fields. Clients fetch it once and cache it, periodically refreshing to pick up changes.