Discover the OAuth server

GET

/.well-known/oauth-authorization-server

const url = 'https://qinto-api.blotout.io/.well-known/oauth-authorization-server';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://qinto-api.blotout.io/.well-known/oauth-authorization-server

Serves the RFC 8414 authorization-server metadata document OAuth and MCP clients use to discover the endpoints, PKCE requirement, and supported scopes.

How it works

The document is public and CORS-enabled so browser-based clients can fetch it cross-origin. The issuer is this API’s origin; the authorization endpoint lives on the Blotout platform origin, where the consent screen renders.

Responses

200

The RFC 8414 metadata document.

application/json

object

issuer

required

The authorization server’s issuer identifier: this API’s origin.

string

authorization_endpoint

required

Where user-facing authorization requests go — the consent screen on the Blotout platform.

string

token_endpoint

required

The token endpoint on this API.

string

revocation_endpoint

required

The RFC 7009 revocation endpoint on this API.

string

grant_types_supported

required

The supported grant types.

Array<string>

response_types_supported

required

The supported response types.

Array<string>

response_modes_supported

required

The supported response modes.

Array<string>

code_challenge_methods_supported

required

The supported PKCE code-challenge methods; PKCE is mandatory.

Array<string>

token_endpoint_auth_methods_supported

required

The client-authentication methods the token endpoint accepts.

Array<string>

revocation_endpoint_auth_methods_supported

required

The client-authentication methods the revocation endpoint accepts.

Array<string>

client_id_metadata_document_supported

required

Always true: clients may identify themselves with an HTTPS client-id metadata document (CIMD).

boolean

scopes_supported

required

Every scope token the grammar accepts, including offline_access, except bundles: an MCP client learns that one from the MCP server.

Array<string>

Example

{
  "issuer": "https://qinto-api.blotout.io",
  "authorization_endpoint": "https://platform.blotout.io/oauth/authorize",
  "token_endpoint": "https://qinto-api.blotout.io/oauth/token",
  "revocation_endpoint": "https://qinto-api.blotout.io/oauth/revoke",
  "grant_types_supported": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types_supported": [
    "code"
  ],
  "response_modes_supported": [
    "query"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "none"
  ],
  "revocation_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "none"
  ],
  "client_id_metadata_document_supported": true,
  "scopes_supported": [
    "team:read",
    "domain:read",
    "offline_access"
  ]
}