OAuth 2.0 Authorization Server Metadata
OAuth 2.0 Authorization Server Metadata, defined in RFC 8414, is a JSON document an authorization server publishes, conventionally at a well-known path derived from its issuer URL, listing the endpoints and capabilities a client needs to use it: the authorization_endpoint and token_endpoint URLs, its jwks_uri, which grant types and PKCE code_challenge_methods it supports, and its registration_endpoint if it accepts Dynamic Client Registration. Rather than a client developer hardcoding each of these values after reading a provider's documentation, a client that already knows only the issuer's base URL can fetch this one document and configure itself against whatever that specific server actually supports, which matters most when a client is expected to work with authorization servers it has never been configured for in advance. The format closely mirrors OpenID Connect Discovery's provider metadata, generalized by the IETF for plain OAuth 2.0 rather than tied to OpenID Connect specifically. The MCP authorization specification requires an MCP server's authorization server to publish this metadata for exactly that reason: a general-purpose MCP client discovers which authorization server protects a given MCP server from its OAuth 2.0 Protected Resource Metadata, then needs this document to actually complete a flow against an authorization server it's never talked to before.
By AdminKit team, Netbase JSC · Updated