Authorization server metadata (RFC 8414)

GET /.well-known/oauth-authorization-server

Endpoint URLs and capabilities of the MCP authorization server. Public, unauthenticated and CORS-open on the same terms as the protected-resource document. `code_challenge_methods_supported: ["S256"]` is load-bearing: it is the only machine-readable statement that PKCE is mandatory and that `plain` will be rejected. Dynamic client registration (RFC 7591) is advertised; client-id metadata documents (CIMD) deliberately are not. Cached for one hour.

Response Body

authorization_endpointstring · uri

code_challenge_methods_supportedstring[]

Possible values:

S256

grant_types_supportedstring[]

Possible values:

authorization_coderefresh_token

issuerstring · uri

registration_endpointstring · uri

response_types_supportedstring[]

revocation_endpointstring · uri

revocation_endpoint_auth_methods_supportedstring[]

scopes_supportedstring[]

Possible values:

mcp:readmcp:writemcp:destructivemcp:toolsopenidemail

service_documentationstring · uri

token_endpointstring · uri

token_endpoint_auth_methods_supportedstring[]

Possible values:

noneclient_secret_postclient_secret_basic

curl -X GET 'https://api.elaichi.ai/.well-known/oauth-authorization-server' \
  -H 'Content-Type: application/json'

const response = await fetch('https://api.elaichi.ai/.well-known/oauth-authorization-server', {
  method: 'GET',
  headers: {
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data);

import os
import requests

url = "https://api.elaichi.ai/.well-known/oauth-authorization-server"
headers = {
    "Content-Type": "application/json",
}

response = requests.get(url, headers=headers)
print(response.json())