Discover the authorization server
GET/.well-known/oauth-authorization-server
RFC 8414 metadata — everything an OAuth library needs to configure itself, built from the same
URLs and scope catalog the server uses. authorization_endpoint is the consent screen on the
app host; the token and revocation endpoints are on the API host.
Throttle: oauth/metadata/ip, 60 a minute per IP.
Responses
- 200
- 429
The server's metadata.
Response Headers
Cache-Control
Every OAuth answer — a token response cached by a proxy is a leaked token (RFC 6749 §5.1).
A throttle refused the request. Wait Retry-After seconds — the time left in the refusing window
plus 0–3 s of jitter. The X-RateLimit-* headers describe the bucket that refused it.
Response Headers
Retry-After
X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-Reset
Seconds until the window rolls.