Remediation
`/.well-known/oauth-authorization-server` is reachable and conforms to RFC 8414, letting agents discover authorization endpoints without out-of-band setup.
discoverability.oauth_authorization_serverdiscoverabilityweight 1deterministic
Why it matters
`/.well-known/oauth-authorization-server` is reachable and conforms to RFC 8414, letting agents discover authorization endpoints without out-of-band setup.
Underlying specification: https://datatracker.ietf.org/doc/html/rfc8414
How to fix
- See the full check definition in the rubric (linked above) for the canonical reference.
- Read the underlying specification at https://datatracker.ietf.org/doc/html/rfc8414.
Hand it to your AI assistant
Paste this into Claude Code, Cursor, or any assistant with your repository open. It carries the steps, how to verify them, and the shortcuts to avoid. It is generic, though: run a scan to get one written from what your pages actually do.
Run a scan to check your site
Verify on your site
Run a scan against your domain to see whether discoverability.oauth_authorization_server currently passes, warns, or fails. Free, no signup; the score page is permanent and citable.