Authorization server metadata (RFC 8414)

GET

/.well-known/oauth-authorization-server

curl --request GET \
  --url https://api.harperharbor.com/.well-known/oauth-authorization-server

• Production

Responses

200

Metadata.

Media typeapplication/json

object

issuer

required

<API_BASE>.

string

authorization_endpoint

required

string

token_endpoint

required

string

registration_endpoint

required

string

revocation_endpoint

required

string

device_authorization_endpoint

<API_BASE>/oauth/device_authorization. Present only when the server offers device sign-in.

string

response_types_supported

required

["code"].

Array<string>

grant_types_supported

required

["authorization_code","refresh_token"], plus urn:ietf:params:oauth:grant-type:device_code when the server offers device sign-in.

Array<string>

code_challenge_methods_supported

required

["S256"].

Array<string>

token_endpoint_auth_methods_supported

required

["none"].

Array<string>

scopes_supported

required

["mcp:card-writer"].

Array<string>

Example^generated

{
  "issuer": "example",
  "authorization_endpoint": "example",
  "token_endpoint": "example",
  "registration_endpoint": "example",
  "revocation_endpoint": "example",
  "device_authorization_endpoint": "example",
  "response_types_supported": [
    "example"
  ],
  "grant_types_supported": [
    "example"
  ],
  "code_challenge_methods_supported": [
    "example"
  ],
  "token_endpoint_auth_methods_supported": [
    "example"
  ],
  "scopes_supported": [
    "example"
  ]
}