Agent readiness check
OAuth discovery metadata is published
A site whose API needs credentials publishes /.well-known/oauth-authorization-server or /.well-known/openid-configuration.
low severityagents.oauth-discovery
Run this check on your site
Runs just this check in quick mode. The report opens with the evidence and the fix.
Why it matters
An agent that must sign in to an API reads the authorization server metadata to find the authorization, token and registration endpoints. Without it, every integration is hand written.
How to fix it
If your API needs credentials, publish /.well-known/oauth-authorization-server (RFC 8414) or /.well-known/openid-configuration with issuer, authorization_endpoint, token_endpoint, jwks_uri and grant_types_supported.
The details
- Category
- Agent readiness
- Severity of a failure
- low
- Confidence
- high
- Needs a browser
- No
- Check id
- agents.oauth-discovery