OAuth 2.0 Authorization Server Metadata
OAuth 2.0 Authorization Server Metadata (RFC 8414, Proposed Standard, June 2018) is a JSON document an authorization server publishes at /.well-known/oauth-authorization-server listing its issuer, endpoints, signing keys location, and supported grant types, scopes, and features, so clients can configure themselves automatically.
It generalizes OpenID Connect Discovery (/.well-known/openid-configuration) to plain OAuth, and the two documents share most field names. Metadata is how a client learns whether a server supports PKCE, PAR, DPoP, or Client ID Metadata Documents without guessing, and it is the second hop of discovery after a resource points to its authorization server through RFC 9728. The security rule that matters is the issuer check: the value in the document must exactly match the issuer the client expected, and with RFC 9207 the iss returned in authorization responses must match too, which is the defense against mix-up attacks when a client talks to more than one authorization server.
See also: protected resource metadata, authorization server, JWKS, OIDC, MCP authorization, OpenID Connect
Related on Start with Identity
- GlossaryOAuth Client ID Metadata Document (CIMD)
An OAuth Client ID Metadata Document (CIMD) is a JSON document of client metadata hosted at an HTTPS URL that the client uses as its `client_id`, so an authoriz
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryResource Indicators for OAuth 2.0
Resource Indicators for OAuth 2.0 ([RFC 8707](https://www.rfc-editor.org/rfc/rfc8707), Proposed Standard, February 2020) define a `resource` request parameter a
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit
- BlogGitLab patches a SAML-to-LDAP account takeover and OIDC discovery cache poisoning
GitLab's October 21 critical patch release fixes CVE-2026-15723, which let a signed-in user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-li