Get authorization server metadata

GET/.well-known/oauth-authorization-server

Describes Chartnaut's OAuth 2.1 authorization server (RFC 8414): the addresses of its endpoints and what it supports. An MCP client reads it once, then registers, authorizes and gets tokens from the addresses it lists.

Scope	Heavy call	Long poll	CLI
None, no key	No	No	None

Guidance

It lives at the root of https://api.chartnaut.com, not under /v1. /.well-known/openid-configuration serves the same document for clients that look there first. Chartnaut is not an OpenID provider and issues no ID tokens.
Every client is public: there are no client secrets, and PKCE with S256 is required on every authorization.
The only grants are authorization_code and refresh_token. There is no client credentials grant; for a program with no person present, use an API key.
Redirects carry iss, so a client can check the answer came from https://api.chartnaut.com.
It is public and cached for 5 minutes.

Response

200 with:

Field	Type	Description
`issuer`	string	`https://api.chartnaut.com`
`authorization_endpoint`	string	Start an authorization
`token_endpoint`	string	Get a token
`registration_endpoint`	string	Register a client
`revocation_endpoint`	string	Revoke a token
`response_types_supported`	array of string	`code`
`response_modes_supported`	array of string	`query`
`grant_types_supported`	array of string	`authorization_code`, `refresh_token`
`code_challenge_methods_supported`	array of string	`S256`
`token_endpoint_auth_methods_supported`	array of string	`none`
`revocation_endpoint_auth_methods_supported`	array of string	`none`
`scopes_supported`	array of string	`scripts:read`, `scripts:write`, `runs:write`
`authorization_response_iss_parameter_supported`	boolean	`true`

Status codes

Status	Code	Meaning
`200`	-	The metadata

Example request

curl https://api.chartnaut.com/.well-known/oauth-authorization-server

Example response

200 OK

{
  "issuer": "https://api.chartnaut.com",
  "authorization_endpoint": "https://api.chartnaut.com/oauth/authorize",
  "token_endpoint": "https://api.chartnaut.com/oauth/token",
  "registration_endpoint": "https://api.chartnaut.com/oauth/register",
  "revocation_endpoint": "https://api.chartnaut.com/oauth/revoke",
  "response_types_supported": ["code"],
  "response_modes_supported": ["query"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "code_challenge_methods_supported": ["S256"],
  "token_endpoint_auth_methods_supported": ["none"],
  "revocation_endpoint_auth_methods_supported": ["none"],
  "scopes_supported": ["scripts:read", "scripts:write", "runs:write"],
  "authorization_response_iss_parameter_supported": true
}

From the CLI

There is no CLI command for this endpoint.