---
title: "Authorization server metadata"
url: https://docs.truemarkets.co/api/auth/oauth-authorization-server-metadata
description: "RFC 8414 discovery. A remote MCP client fetches this to learn where to"
---

Docs index: https://docs.truemarkets.co/llms.txt

# Authorization server metadata

```
GET https://api.truemarkets.co/.well-known/oauth-authorization-server
```

RFC 8414 discovery. A remote MCP client fetches this to learn where to
register and authorize, having been configured with nothing but the
MCP server URL.

`issuer` must equal the origin this document is served from, which is
why it is mounted at the root rather than under `/v1/auth`. The
endpoints it names do sit under that base path; RFC 8414 does not
require them to share the issuer's prefix.

Served `no-store`: a client that cached this across a key or endpoint
rotation would fail in a way that looks like our outage.

## Responses

Every error status returns the same body, described in [Errors](https://docs.truemarkets.co/developer-resources/errors.md).

### 200

The authorization server's published identity

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `issuer` | string (uri) | yes | Equals the origin this document is served from. |
| `authorization_endpoint` | string (uri) | yes |  |
| `token_endpoint` | string (uri) | yes |  |
| `registration_endpoint` | string (uri) | yes | Dynamic client registration (RFC 7591). |
| `jwks_uri` | string (uri) | yes |  |
| `scopes_supported` | array of string | yes |  |
| `response_types_supported` | array of string | yes |  |
| `grant_types_supported` | array of string | yes |  |
| `code_challenge_methods_supported` | array of string | yes | S256 only; OAuth 2.1 drops "plain". |
| `token_endpoint_auth_methods_supported` | array of string | yes |  |
| `resources_supported` | array of string (uri) | no | RFC 8707 resource identifiers tokens may be minted for. |