{"id":"ia.oauth-discovery","name":"OAuth discovery","verify":{"command":"curl -sf https://{domain}/.well-known/oauth-authorization-server | jq -e '.issuer and .token_endpoint'","rescan":"isagentready results {domain} --checkpoint ia.oauth-discovery","expect":"exit code 0"},"fix":{"steps":[{"action":"Serve the RFC 8414 metadata with issuer, authorization_endpoint and token_endpoint.","order":1,"language":"json","code_example":"{\n  \"issuer\": \"https://example.com\",\n  \"authorization_endpoint\": \"https://example.com/oauth/authorize\",\n  \"token_endpoint\": \"https://example.com/oauth/token\",\n  \"code_challenge_methods_supported\": [\"S256\"]\n}"}],"summary":"Publish OAuth authorization server metadata at /.well-known/oauth-authorization-server.","skill":{"name":"security-trust","anchor":"ia.oauth-discovery"}},"category":"security","aggregate":null,"references":[{"title":"RFC 8414: OAuth 2.0 Authorization Server Metadata","kind":"spec","url":"https://datatracker.ietf.org/doc/html/rfc8414"},{"title":"OpenID Connect Discovery 1.0","kind":"spec","url":"https://openid.net/specs/openid-connect-discovery-1_0.html"}],"stage":"act","lifecycle":{"introduced":"2026-08-24","revised":[],"retired":null,"replaced_by":null},"methodology_version":"2026-10-22","evidence_tier":"standard","evidence_source":{"title":"agentready.org AR-ACT-01","url":"https://www.agentready.org/#act"},"why":"OAuth and OIDC discovery (RFC 8414, OpenID Connect Discovery 1.0) let agents authenticate with your APIs without manual setup.","profiles":["api_tool_readiness","agentic_commerce"],"score_role":"core","legacy_id":"5.12","i18n":{"nl":{"name":"OAuth-discovery","steps":["Lever de RFC 8414-metadata met issuer, authorization_endpoint en token_endpoint."],"why":"OAuth- en OIDC-discovery (RFC 8414, OpenID Connect Discovery 1.0) laten agents bij je API's authenticeren zonder handmatige setup.","fix_summary":"Publiceer OAuth-metadata van de autorisatieserver op /.well-known/oauth-authorization-server.","verify_expect":"exitcode 0"}},"ar_practice_ids":["AR-ACT-01"],"strength":"SHOULD","ar_mapping":"full","evidence_type":"scanner_data","detail_url":"https://isagentready.com/en/methodology/checkpoints/ia.oauth-discovery","maturity":"recommended","applicability":{"mode":"detected_surface","condition":null,"surfaces":["auth"]}}