---
name: oauth-discovery
title: OAuth discovery
category: discovery
---

# OAuth discovery

OAuth and OIDC discovery documents publish the issuer, authorization endpoint, token endpoint and keys an agent needs to authenticate.

## When to use this skill

Use this when a site fails the "OAuth discovery" check and you need to implement it.

## Goal

Publish OAuth/OIDC discovery metadata so agents can authenticate with your APIs

## Pass criteria

/.well-known/oauth-authorization-server or /.well-known/openid-configuration exposes usable metadata.

## Implementation

This skill covers the diagnosis. The step-by-step implementation prompt is part
of the paid tier and is served per scan by the API — see https://agent-ready.t0ols.com/llms-full.txt.

## Specifications

- https://www.rfc-editor.org/rfc/rfc8414
- https://openid.net/specs/openid-connect-discovery-1_0.html

## Verifying

Re-run the scan against the site and confirm the check reports a pass:

    curl -s https://agent-ready.t0ols.com/api/scan \
      -H 'content-type: application/json' \
      -d '{"url":"https://example.com","enabledChecks":["oauthDiscovery"]}'