OAuth discovery
OAuth and OIDC discovery documents publish the issuer, authorization endpoint, token endpoint and keys an agent needs to authenticate.
Why it matters
An agent that can self-configure an OAuth client does not need a human to paste credentials into a config file.
Pass criteria
/.well-known/oauth-authorization-server or /.well-known/openid-configuration exposes usable metadata.
Every request the check makes is recorded (URL, method, response status, relevant headers and a body preview) and shown under the check in your results.
How to implement it
Publish OAuth/OIDC discovery metadata so agents can authenticate with your APIs
/.well-known/oauth-authorization-server or /.well-known/openid-configuration exposes usable metadata.
The step-by-step implementation prompt is part of the Pro plan.
See plansScan your site
See whether this check passes on your domain, along with the other 21.
Related checks
API Catalog
/.well-known/api-catalog returns application/linkset+json with at least one entry.
OAuth Protected Resource
/.well-known/oauth-protected-resource declares resource and authorization_servers.
Auth.md
/auth.md exists with a markdown H1 mentioning auth.md.
MCP Server Card
/.well-known/mcp/server-card.json describes the server with a serverInfo.name.
A2A Agent Card
/.well-known/agent-card.json declares name, version and supported interfaces.
Agent Skills
/.well-known/agent-skills/index.json lists at least one skill.
WebMCP
Page code registers browser-side tools through navigator.modelContext.
ARD manifest
/.well-known/ai-catalog.json declares specVersion, host and at least one entry.