Discovery Mechanism for Authorization Servers

Security Requirement

Authorization servers MUST provide at least one of the following discovery mechanisms:

1. OAuth 2.0 Authorization Server Metadata (RFC 8414)
2. OpenID Connect Discovery 1.0

MCP clients are required to support both, so the authorization server MUST implement at least one to ensure interoperability.

Option 1: OAuth 2.0 Authorization Server Metadata (RFC 8414)

Expose metadata at /.well-known/oauth-authorization-server: