# authorization-server-metadata

Source: https://startwithidentity.com/glossary/authorization-server-metadata/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

OAuth 2.0 Authorization Server Metadata ([RFC 8414](https://www.rfc-editor.org/rfc/rfc8414), Proposed Standard, June 2018) is a JSON document an authorization server publishes at `/.well-known/oauth-authorization-server` listing its issuer, endpoints, signing keys location, and supported grant types, scopes, and features, so clients can configure themselves automatically.

It generalizes OpenID Connect Discovery (`/.well-known/openid-configuration`) to plain OAuth, and the two documents share most field names. Metadata is how a client learns whether a server supports PKCE, PAR, DPoP, or Client ID Metadata Documents without guessing, and it is the second hop of discovery after a resource points to its authorization server through RFC 9728. The security rule that matters is the `issuer` check: the value in the document must exactly match the issuer the client expected, and with RFC 9207 the `iss` returned in authorization responses must match too, which is the defense against mix-up attacks when a client talks to more than one authorization server.

See also: [protected resource metadata](https://startwithidentity.com/glossary/protected-resource-metadata/), [authorization server](https://startwithidentity.com/glossary/authorization-server/), [JWKS](https://startwithidentity.com/glossary/jwks/), [OIDC](https://startwithidentity.com/glossary/oidc/), [MCP authorization](https://startwithidentity.com/glossary/mcp-authorization/), [OpenID Connect](https://startwithidentity.com/standards/openid-connect/)