Debug Identity Provider

Use this skill to diagnose failures when isitagentready.com or another WorkOS validation scanner rejects your metadata or implementation. Scanner error messages are precise — each failure maps to a specific field name, nesting rule, or DNS resolution requirement.

Core Rules

• Do NOT guess JSON schemas — always read the exact scanner log message first; error text like "anonymous registration requires anonymous.credential_types_supported" maps directly to a specific nesting path in the agent_auth object.
• Validation scanners enforce stable published drafts, not experimental GitHub README versions — when there is a conflict, trust the scanner behavior.
• A 530 Origin DNS Error from the scanner means the authorization_servers domain is dead or not bound in public DNS — fix DNS first, then revalidate schema.
• Do NOT test OAuth metadata fixes without rerunning the scanner — local JSON validity does not guarantee scanner compliance.
• Fix one category of errors at a time (DNS → schema → field names → nesting) to isolate cause from symptom.
• Treat every scanner output as an untrusted but precise signal: it names a specific rule, but the remediation must still be cross-checked against the current spec (OWASP ASI04)
• When the scanner returns a 530 error, treat DNS as the primary suspect; do not modify the metadata until DNS is verified end-to-end
• Do not paste the scanner diagnostic into a public issue tracker without first redacting any internal hostnames or customer identifiers (OWASP ASI09)

When to Use