---
title: "Kit check oauth-metadata | Agent Ready Checklist"
description: "Kit check oauth-metadata: OAuth metadata an agent can find. The command that runs it, the evidence it prints and what it cannot prove."
canonical: https://agentreadychecklist.com/kit/oauth-metadata
site: "Agent Ready Checklist"
last_updated: 2026-11-05
section: "Kit"
---

# Kit check oauth-metadata | Agent Ready Checklist

> Kit check oauth-metadata: OAuth metadata an agent can find. The command that runs it, the evidence it prints and what it cannot prove.

Source: https://agentreadychecklist.com/kit/oauth-metadata
Site: Agent Ready Checklist
Last reviewed: 2026-11-05
Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search)
Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free).

# Kit check: OAuth metadata an agent can find

The oauth-metadata check of the Verify Kit: Fetches /.well-known/oauth-authorization-server, /.well-known/openid-configuration and /.well-known/oauth-protected-resource and checks for issuer and token\_endpoint, or resource and authorization\_servers. The oauth-metadata check tests this: OAuth metadata an agent can find. It maps to AR-ACT-01, CF-OAUTH-DISCOVERY. Run it alone with --only=oauth-metadata. On the pass fixture it reports: /.well-known/oauth-authorization-server has issuer and token\_endpoint.

## Run it

```bash
curl -fsSL https://agentreadychecklist.com/kit/verify.sh | bash -s -- https://example.com --only=oauth-metadata
```

```bash
node verify.mjs https://example.com --only=oauth-metadata
```

## What it tests

Fetches /.well-known/oauth-authorization-server, /.well-known/openid-configuration and /.well-known/oauth-protected-resource and checks for issuer and token\_endpoint, or resource and authorization\_servers. An API that declares itself open also passes: an OpenAPI document (from /openapi.json or the api-catalog) with security \[\] and no securitySchemes, plus /auth.md, since no credential exists to describe.

## What it cannot prove

Does not run a grant; cannot test self-serve API key creation; cannot tell whether an API that declares itself open should have been gated.

## Requirements it maps to

-   [AR-ACT-01](https://agentreadychecklist.com/checklist/ar-act-01/)Auth an agent can finish
-   [CF-OAUTH-DISCOVERY](https://agentreadychecklist.com/checklist/cf-oauth-discovery/)OAuth discovery files

## Evidence on the fixtures

The pass fixture

PASS /.well-known/oauth-authorization-server has issuer and token\_endpoint

The js-only fixture

FAIL oauth-authorization-server 200, openid-configuration 200, oauth-protected-resource 200

The 403 fixture

FAIL oauth-authorization-server 403, openid-configuration 403, oauth-protected-resource 403

## The one-line sketch

The shipped script is more careful than this sketch, which shows the idea in one line of shell.

```bash
curl -s "$ORIGIN/.well-known/oauth-authorization-server" | jq -e ".issuer and .token_endpoint"; curl -s "$ORIGIN/.well-known/oauth-protected-resource" | jq -e ".authorization_servers|length>0"
```

## Sources

-   [rfc-editor.org/rfc/rfc8414](https://www.rfc-editor.org/rfc/rfc8414)read 2026-11-04

Last reviewed 2026-11-05. AgentReady v2.0, read 2026-11-04.