Skip to content
Methodology

OAuth discovery

ia.oauth-discovery · 5.12

Act SHOULD Scanner data AR-ACT-01

Why it matters

OAuth and OIDC discovery (RFC 8414, OpenID Connect Discovery 1.0) let agents authenticate with your APIs without manual setup.

How to fix it

Publish OAuth authorization server metadata at /.well-known/oauth-authorization-server.

  1. Serve the RFC 8414 metadata with issuer, authorization_endpoint and token_endpoint.

    {
  "issuer": "https://example.com",
  "authorization_endpoint": "https://example.com/oauth/authorize",
  "token_endpoint": "https://example.com/oauth/token",
  "code_challenge_methods_supported": ["S256"]
}

Verify

curl -sf https://{domain}/.well-known/oauth-authorization-server | jq -e '.issuer and .token_endpoint'

Expected: exit code 0

Run a new scan for this checkpoint:

isagentready results {domain} --checkpoint ia.oauth-discovery
Details Mapping, lifecycle and references
AR mapping
Full match
Score role
Core
Introduced
2026-08-24
Methodology version
2026-10-22

Checkpoint data (JSON)