--- title: "CF-OAUTH-DISCOVERY: OAuth discovery files | Agent Ready Checklist" description: "CF-OAUTH-DISCOVERY (CLOUDFLARE, Act layer): OAuth discovery files. What it asks, the evidence, the command that verifies it and the fix on 19 platforms." canonical: https://agentreadychecklist.com/checklist/cf-oauth-discovery site: "Agent Ready Checklist" last_updated: 2026-11-05 section: "Checklist" --- # CF-OAUTH-DISCOVERY: OAuth discovery files | Agent Ready Checklist > CF-OAUTH-DISCOVERY (CLOUDFLARE, Act layer): OAuth discovery files. What it asks, the evidence, the command that verifies it and the fix on 19 platforms. Source: https://agentreadychecklist.com/checklist/cf-oauth-discovery Site: Agent Ready Checklist Last reviewed: 2026-11-05 Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search) Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free). # CF-OAUTH-DISCOVERY: OAuth discovery files CF-OAUTH-DISCOVERY is a Cloudflare scanner check on the act layer: Serve OAuth or OIDC discovery JSON at /.well-known/oauth-authorization-server or /.well-known/openid-configuration with issuer, authorization\_endpoint, token\_endpoint and jwks\_uri; serve RFC 9728 metadata at /.well-known/oauth-protected-resource. It applies to sites with sign-in or a gated API. 19 of 19 platforms have a recipe below, 11 of them workarounds. 3 cited facts back it. ## The requirement Identifier CF-OAUTH-DISCOVERY Level CLOUDFLARE Layer Act Applies to sites with sign-in or a gated API Checked by Ora, matched on this site, Cloudflare oauthDiscovery, Cloudflare oauthProtectedResource, Verify Kit oauth-metadata Ora check [oauth-protected-resource](#ora) The statement Serve OAuth or OIDC discovery JSON at /.well-known/oauth-authorization-server or /.well-known/openid-configuration with issuer, authorization\_endpoint, token\_endpoint and jwks\_uri; serve RFC 9728 metadata at /.well-known/oauth-protected-resource. ## Why - Cloudflare checks both OAuth discovery (RFC 8414 or OIDC) and OAuth Protected Resource (RFC 9728) as separate checks.primary source, 2026-11-04: [isitagentready.com](https://isitagentready.com/), read 2026-11-04 - Protected resource metadata must include resource and authorization\_servers; a 401 may return WWW-Authenticate with resource\_metadata.primary source: [isitagentready.com/.well-known/agent-skills/oauth-protected-resource/SKILL.md](https://isitagentready.com/.well-known/agent-skills/oauth-protected-resource/SKILL.md), read 2026-11-04 - Cloudflare Access supports the OAuth flow agents use with protected URLs, announced at Agents Week 2026.primary source, 2026-04-17: [blog.cloudflare.com/agent-readiness/](https://blog.cloudflare.com/agent-readiness/), read 2026-11-04 ## How to verify ### [OAuth metadata an agent can find](https://agentreadychecklist.com/kit/oauth-metadata/) ```bash curl -fsSL https://agentreadychecklist.com/kit/verify.sh | bash -s -- https://example.com --only=oauth-metadata ``` Fetches /.well-known/oauth-authorization-server, /.well-known/openid-configuration and /.well-known/oauth-protected-resource and checks for issuer and token\_endpoint, or resource and authorization\_servers. An API that declares itself open also passes: an OpenAPI document (from /openapi.json or the api-catalog) with security \[\] and no securitySchemes, plus /auth.md, since no credential exists to describe. **It cannot prove:** Does not run a grant; cannot test self-serve API key creation; cannot tell whether an API that declares itself open should have been gated. ### The one-line version curl -s /.well-known/oauth-protected-resource | jq -e ".authorization\_servers | length > 0". ## Verify with Ora One check in Ora's catalogue (contract 1.38.0, read 2026-11-05) read this row. Each entry says what the check looks at and why this page lists it. - `oauth-protected-resource` OAuth Protected Resource metadata (RFC 9728) Looks for RFC 9728 metadata at /.well-known/oauth-protected-resource. A bonus check. Usability, 2 points, bonus, required; catalogue applicability domain-only. Listed because: same name, `rfc 9728`. ### Run just these checks ```bash curl -s -X POST https://ora.ai/api/scan/checks -H 'content-type: application/json' -d '{"url":"https://example.com","checkIds":["oauth-protected-resource"]}' ``` This calls the endpoint Ora documents for re-verifying a fix. It sends no cache, returns a result for each id and no total score, and spends one scan from the daily budget. Replace the URL with yours. [How to re-verify one fix](https://agentreadychecklist.com/guides/re-verify-one-fix-with-ora/). ### Or audit the whole site ```bash npx ax@0.10 audit https://example.com --min-score 70 ``` Exit code 1 means the score is below the number you passed, so the same line gates a deploy: [the CI recipe](https://agentreadychecklist.com/guides/gate-deploys-on-agent-readiness-in-ci/). [Why this site recommends Ora, and where it falls short](https://agentreadychecklist.com/verify-with-ora/). ## Fix it on your platform ### Next.js (App Router)recipe Return the RFC 8414 JSON (issuer, authorization\_endpoint, token\_endpoint, jwks\_uri) from app/.well-known/oauth-authorization-server/route.ts. Next.js 16.x (npm latest 16.4.5, read 2026-11-04); docs at nextjs.org/docs/app. Read 2026-11-04. [nextjs.org/docs/app/api-reference/file-conventions/route](https://nextjs.org/docs/app/api-reference/file-conventions/route). [All Next.js (App Router) recipes](https://agentreadychecklist.com/platforms/nextjs-app-router/#cf-oauth-discovery) ### Astrorecipe Serve public/.well-known/oauth-authorization-server (JSON) or an endpoint at src/pages/.well-known/oauth-authorization-server.ts that returns Response.json(metadata). Astro 7.x (npm latest astro 7.4.5, @astrojs/sitemap 3.7.4, read 2026-11-04). Read 2026-11-04. [docs.astro.build/en/guides/endpoints/](https://docs.astro.build/en/guides/endpoints/). [All Astro recipes](https://agentreadychecklist.com/platforms/astro/#cf-oauth-discovery) ### Nuxtrecipe Return the RFC 8414 JSON from server/routes/.well-known/oauth-authorization-server.ts with defineEventHandler. Nuxt 4.x (npm latest nuxt 4.6.4, @nuxtjs/robots 7.0.2, @nuxtjs/sitemap 9.1.0, read 2026-11-04). Read 2026-11-04. [nuxt.com/docs/guide/directory-structure/server](https://nuxt.com/docs/guide/directory-structure/server). [All Nuxt recipes](https://agentreadychecklist.com/platforms/nuxt/#cf-oauth-discovery) ### SvelteKitrecipe Return the RFC 8414 metadata from src/routes/.well-known/oauth-authorization-server/+server.ts with json(metadata). SvelteKit (npm latest @sveltejs/kit 3.1.1, read 2026-11-04); docs at svelte.dev/docs/kit. Read 2026-11-04. [svelte.dev/docs/kit/routing](https://svelte.dev/docs/kit/routing). [All SvelteKit recipes](https://agentreadychecklist.com/platforms/sveltekit/#cf-oauth-discovery) ### Remix and React Router (framework mode)recipe Return RFC 8414 JSON from a resource route at /.well-known/oauth-authorization-server. React Router framework mode (npm latest react-router 8.5.1; Remix v2 @remix-run/node 2.17.5, read 2026-11-04); docs at reactrouter.com. Read 2026-11-04. [reactrouter.com/how-to/resource-routes](https://reactrouter.com/how-to/resource-routes). [All Remix and React Router (framework mode) recipes](https://agentreadychecklist.com/platforms/remix-react-router/#cf-oauth-discovery) ### Plain static hosting (Netlify, Vercel static, Cloudflare Pages, GitHub Pages, S3 and CloudFront)workaround A static file works when the metadata is fixed: upload .well-known/oauth-authorization-server and set Content-Type: application/json in \_headers (the file has no extension). The authorization server itself must run elsewhere. Host documentation as published on 2026-11-04 (no version numbers; config files \_headers, \_redirects, vercel.json, 404.html). Read 2026-11-04. [docs.netlify.com/manage/routing/headers/](https://docs.netlify.com/manage/routing/headers/). [All Plain static hosting (Netlify, Vercel static, Cloudflare Pages, GitHub Pages, S3 and CloudFront) recipes](https://agentreadychecklist.com/platforms/static-hosting/#cf-oauth-discovery) ### WordPress and Elementorworkaround Core ships application passwords, not an OAuth server. Install an OAuth server plugin that publishes /.well-known/oauth-authorization-server, or upload the metadata file to the web root and point it at your real authorization server. WordPress 7.1.4 (core release from the version-check API), Elementor 4.3.6 (plugin directory, updated 2026-11-02), Yoast SEO 28.8 noted for llms.txt; docs read 2026-11-04. Read 2026-11-04. [developer.wordpress.org/reference/functions/add\_rewrite\_rule/](https://developer.wordpress.org/reference/functions/add_rewrite_rule/). [All WordPress and Elementor recipes](https://agentreadychecklist.com/platforms/wordpress-elementor/#cf-oauth-discovery) ### Shopify (Online Store 2.0 themes)workaround Merchants cannot publish /.well-known/oauth-authorization-server on the storefront domain. Workaround: publish OAuth metadata on your own API domain if you run one. Hosted SaaS, Online Store 2.0 Liquid themes, docs read 2026-11-04; storefront behaviour probed live on one Shopify store the same day. Read 2026-11-04. [shopify.dev/docs/apps/build/online-store/app-proxies](https://shopify.dev/docs/apps/build/online-store/app-proxies). [All Shopify (Online Store 2.0 themes) recipes](https://agentreadychecklist.com/platforms/shopify/#cf-oauth-discovery) ### Webflowworkaround Not hostable on the Webflow origin. Serve /.well-known/oauth-authorization-server from a Webflow Cloud app, your auth domain or a reverse proxy. Hosted SaaS, help center articles read 2026-11-04 (updated dates 2024-10-14 to 2026-10-29). Read 2026-11-04. [help.webflow.com/hc/en-us/articles/49835650986259-Set-up-a-self-managed-reverse-proxy-in-Webflow](https://help.webflow.com/hc/en-us/articles/49835650986259-Set-up-a-self-managed-reverse-proxy-in-Webflow). [All Webflow recipes](https://agentreadychecklist.com/platforms/webflow/#cf-oauth-discovery) ### Framerworkaround Static Files accepts files without extensions, but their MIME type decides whether they render or download; serve /.well-known/oauth-authorization-server from your auth domain if the Framer copy is not returned as application/json. Hosted SaaS, help articles read 2026-11-04 (marked updated 2026-09-15). Read 2026-11-04. [framer.com/help/articles/static-files/](https://www.framer.com/help/articles/static-files/). [All Framer recipes](https://agentreadychecklist.com/platforms/framer/#cf-oauth-discovery) ### Wix (Wix Editor and Wix Studio)workaround No /.well-known/ hosting. Workaround: publish OAuth metadata on your own auth or API domain. Hosted SaaS, help center read 2026-11-04. Read 2026-11-04. [dev.wix.com/docs/go-headless/wix-managed-headless/full-integration-astro/feature-guides/seo/about-seo-support](https://dev.wix.com/docs/go-headless/wix-managed-headless/full-integration-astro/feature-guides/seo/about-seo-support). [All Wix (Wix Editor and Wix Studio) recipes](https://agentreadychecklist.com/platforms/wix/#cf-oauth-discovery) ### Squarespace (version 7.1)workaround No /.well-known/ hosting. Not possible on this platform; workaround: publish OAuth metadata on your own auth domain. Hosted SaaS, version 7.1 sites, help center read 2026-11-04 (articles updated 2026-07-17 to 2026-11-03). Read 2026-11-04. [support.squarespace.com/hc/en-us/articles/205815908-Customize-parts-of-your-site-with-code-injection](https://support.squarespace.com/hc/en-us/articles/205815908-Customize-parts-of-your-site-with-code-injection). [All Squarespace (version 7.1) recipes](https://agentreadychecklist.com/platforms/squarespace/#cf-oauth-discovery) ### HubSpot CMS (Content Hub)workaround No /.well-known/ hosting on HubSpot pages; serve the metadata from your auth domain. Project serverless functions run under fixed endpoint paths, not /.well-known/. Hosted SaaS, Content Hub, knowledge base and developer docs read 2026-11-04. Read 2026-11-04. [developers.hubspot.com/docs/cms/start-building/features/serverless-functions/overview](https://developers.hubspot.com/docs/cms/start-building/features/serverless-functions/overview). [All HubSpot CMS (Content Hub) recipes](https://agentreadychecklist.com/platforms/hubspot-cms/#cf-oauth-discovery) ### Docusaurusworkaround A static file works when the metadata is fixed: add static/.well-known/oauth-authorization-server and set Content-Type: application/json at the host, since the file has no extension. The authorization server itself must run elsewhere, because Docusaurus is a static site generator. 3.10.2 (npm @docusaurus/core latest, read 2026-11-04). Derived from Docusaurus's documentation read on 2026-11-04. [docusaurus.io/docs/deployment](https://docusaurus.io/docs/deployment) and [isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md](https://isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md). [All Docusaurus recipes](https://agentreadychecklist.com/platforms/docusaurus/#cf-oauth-discovery) ### Mintlifyrecipe Sites with authentication advertise OAuth protected resource metadata with rel="oauth-protected-resource" in the Link header; the authed MCP uses OAuth 2. Hosted SaaS, docs read 2026-11-04. Read 2026-11-04. [mintlify.com/docs/ai/llmstxt](https://mintlify.com/docs/ai/llmstxt). [All Mintlify recipes](https://agentreadychecklist.com/platforms/mintlify/#cf-oauth-discovery) ### GitBookrecipe Fully authenticated sites let MCP clients sign in through MCP discovery and OAuth. Hosted SaaS, docs read 2026-11-04. Read 2026-11-04. [gitbook.com/docs/ai-for-your-readers/mcp-servers-for-published-docs](https://gitbook.com/docs/ai-for-your-readers/mcp-servers-for-published-docs). [All GitBook recipes](https://agentreadychecklist.com/platforms/gitbook/#cf-oauth-discovery) ### ReadMerecipe For docs behind OAuth sign-in, set Discovery Type under Authentication and Access; keep None for public docs (endpoints then return 404). Hosted SaaS, docs read 2026-11-04. Read 2026-11-04. [docs.readme.com/main/docs/ai-discoverability](https://docs.readme.com/main/docs/ai-discoverability). [All ReadMe recipes](https://agentreadychecklist.com/platforms/readme/#cf-oauth-discovery) ### Salesforce B2C Commerce (SFRA and PWA Kit / Composable Storefront)workaround B2C Commerce already has an authorization server, SLAS, whose token requests use grant types defined by OAuth 2.1, so you run none. To publish RFC 8414 metadata for it at your own domain's /.well-known path, serve a static file through ssr.js with the app.get pattern; the SLAS page does not say whether SLAS publishes discovery metadata of its own. Hosted SaaS (B2C Commerce help release 264.0.0); PWA Kit retail-react-app 10.3.0 and pwa-kit-runtime 3.21.0 on npm, read 2026-11-04. Derived from Salesforce B2C Commerce's documentation read on 2026-11-04. [developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html) and [developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/create-a-sitemap.html](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/create-a-sitemap.html). [All Salesforce B2C Commerce (SFRA and PWA Kit / Composable Storefront) recipes](https://agentreadychecklist.com/platforms/salesforce-commerce-cloud/#cf-oauth-discovery) ### Adobe Commerce and Magento Open Sourceworkaround Adobe Commerce integrations authenticate with OAuth 1.0a, so Commerce itself publishes no OAuth 2.0 authorization server metadata. Workaround: run an OAuth 2.0 authorization server in front, such as an identity provider, and serve its RFC 8414 metadata the way the AR-FIND-04 recipe serves the catalog (/platforms/adobe-commerce/#ar-find-04). 2.4.9 (GitHub tag published 2026-05-12; 2.4.10-alpha1 tagged 2026-10-13); release notes read 2026-11-04. Derived from Adobe Commerce and Magento Open Source's documentation read on 2026-11-04. [developer.adobe.com/commerce/webapi/get-started/authentication/gs-authentication-oauth](https://developer.adobe.com/commerce/webapi/get-started/authentication/gs-authentication-oauth) and [isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md](https://isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md). [All Adobe Commerce and Magento Open Source recipes](https://agentreadychecklist.com/platforms/adobe-commerce/#cf-oauth-discovery) ## What it does not do - AgentReady folds this into AR-ACT-01 as a SHOULD; Cloudflare scores the file on its own. - A metadata file does not prove dynamic client registration works. ## Common mistakes - Metadata only on the identity provider host, nothing on the resource host. ## Related - Guide: [How to add OAuth metadata](https://agentreadychecklist.com/guides/add-oauth-metadata/) - Term: [.well-known](https://agentreadychecklist.com/glossary/well-known/) ## Sources - [isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md](https://isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md)read 2026-11-04 - [isitagentready.com](https://isitagentready.com/)read 2026-11-04 - [isitagentready.com/.well-known/agent-skills/oauth-protected-resource/SKILL.md](https://isitagentready.com/.well-known/agent-skills/oauth-protected-resource/SKILL.md)read 2026-11-04 - [blog.cloudflare.com/agent-readiness/](https://blog.cloudflare.com/agent-readiness/)read 2026-11-04 - [nextjs.org/docs/app/api-reference/file-conventions/route](https://nextjs.org/docs/app/api-reference/file-conventions/route)read 2026-11-04 - [docs.astro.build/en/guides/endpoints/](https://docs.astro.build/en/guides/endpoints/)read 2026-11-04 - [nuxt.com/docs/guide/directory-structure/server](https://nuxt.com/docs/guide/directory-structure/server)read 2026-11-04 - [svelte.dev/docs/kit/routing](https://svelte.dev/docs/kit/routing)read 2026-11-04 - [reactrouter.com/how-to/resource-routes](https://reactrouter.com/how-to/resource-routes)read 2026-11-04 - [docs.netlify.com/manage/routing/headers/](https://docs.netlify.com/manage/routing/headers/)read 2026-11-04 - [developer.wordpress.org/reference/functions/add\_rewrite\_rule/](https://developer.wordpress.org/reference/functions/add_rewrite_rule/)read 2026-11-04 - [shopify.dev/docs/apps/build/online-store/app-proxies](https://shopify.dev/docs/apps/build/online-store/app-proxies)read 2026-11-04 - [help.webflow.com/hc/en-us/articles/49835650986259-Set-up-a-self-managed-reverse-proxy-in-Webflow](https://help.webflow.com/hc/en-us/articles/49835650986259-Set-up-a-self-managed-reverse-proxy-in-Webflow)read 2026-11-04 - [framer.com/help/articles/static-files/](https://www.framer.com/help/articles/static-files/)read 2026-11-04 - [dev.wix.com/docs/go-headless/wix-managed-headless/full-integration-astro/feature-guides/seo/about-seo-support](https://dev.wix.com/docs/go-headless/wix-managed-headless/full-integration-astro/feature-guides/seo/about-seo-support)read 2026-11-04 - [support.squarespace.com/hc/en-us/articles/205815908-Customize-parts-of-your-site-with-code-injection](https://support.squarespace.com/hc/en-us/articles/205815908-Customize-parts-of-your-site-with-code-injection)read 2026-11-04 - [developers.hubspot.com/docs/cms/start-building/features/serverless-functions/overview](https://developers.hubspot.com/docs/cms/start-building/features/serverless-functions/overview)read 2026-11-04 - [docusaurus.io/docs/deployment](https://docusaurus.io/docs/deployment)read 2026-11-04 - [mintlify.com/docs/ai/llmstxt](https://mintlify.com/docs/ai/llmstxt)read 2026-11-04 - [gitbook.com/docs/ai-for-your-readers/mcp-servers-for-published-docs](https://gitbook.com/docs/ai-for-your-readers/mcp-servers-for-published-docs)read 2026-11-04 - [docs.readme.com/main/docs/ai-discoverability](https://docs.readme.com/main/docs/ai-discoverability)read 2026-11-04 - [developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas.html)read 2026-11-04 - [developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/create-a-sitemap.html](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/create-a-sitemap.html)read 2026-11-04 - [developer.adobe.com/commerce/webapi/get-started/authentication/gs-authentication-oauth](https://developer.adobe.com/commerce/webapi/get-started/authentication/gs-authentication-oauth)read 2026-11-04 - [rfc-editor.org/rfc/rfc8414](https://www.rfc-editor.org/rfc/rfc8414)read 2026-11-04 - [ora.ai/api/checks, contract 1.38.0](https://ora.ai/api/checks?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=requirement)read 2026-11-05 - [ora.ai/llms-full.txt](https://ora.ai/llms-full.txt?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=requirement)read 2026-11-05 - [registry.npmjs.org/ax, the ax README](https://registry.npmjs.org/ax)read 2026-11-05 Verify with Ora The scanner this site recommends for the whole checklist. 132 checks, a score out of 100, no account. `npx ax@0.10 audit --min-score ` [Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/) Fix it on - [Next.js (App Router)recipe](#p-nextjs-app-router) - [Astrorecipe](#p-astro) - [Nuxtrecipe](#p-nuxt) - [SvelteKitrecipe](#p-sveltekit) - [Remix and React Router (framework mode)recipe](#p-remix-react-router) - [Plain static hosting (Netlify, Vercel static, Cloudflare Pages, GitHub Pages, S3 and CloudFront)workaround](#p-static-hosting) - [WordPress and Elementorworkaround](#p-wordpress-elementor) - [Shopify (Online Store 2.0 themes)workaround](#p-shopify) - [Webflowworkaround](#p-webflow) - [Framerworkaround](#p-framer) - [Wix (Wix Editor and Wix Studio)workaround](#p-wix) - [Squarespace (version 7.1)workaround](#p-squarespace) - [HubSpot CMS (Content Hub)workaround](#p-hubspot-cms) - [Docusaurusworkaround](#p-docusaurus) - [Mintlifyrecipe](#p-mintlify) - [GitBookrecipe](#p-gitbook) - [ReadMerecipe](#p-readme) - [Salesforce B2C Commerce (SFRA and PWA Kit / Composable Storefront)workaround](#p-salesforce-commerce-cloud) - [Adobe Commerce and Magento Open Sourceworkaround](#p-adobe-commerce) Last reviewed 2026-11-05. AgentReady v2.0, read 2026-11-04.