Get now

OAuth Authorization Server discovery

RFC 8414 metadata lets agents discover how to obtain authorisation.

Standard
Recommended
10%Top 100 adoption9 of 91 sites implement it7/9OverviewGaining tractionReal support exists and adoption is growing.

Who supports it

  • ChatGPTSupported (announced)

    Undated · last checked 9 Oct 2026: Apps SDK: Authentication'Your identity provider must expose one of the well-known discovery documents so ChatGPT can read its configuration' (OAuth 2.0 metadata or OpenID configuration).

  • ClaudeSupported (announced)

    Undated · last checked 9 Oct 2026: Authentication for connectors (Claude docs)Says the authorization server 'must serve its own discovery metadata, either RFC 8414 authorization server metadata or OpenID Connect Discovery 1.0, at its /.well-known/ paths'. Applies to claude.ai, Desktop, mobile, Claude Code and Cowork.

  • Claude CodeSupported (announced)

    Published 25 Jun 2025 · last checked 9 Oct 2026: Claude Code CHANGELOG (v1.0.35)v1.0.35: 'Added support for MCP OAuth Authorization Server discovery'. Date is the npm release date.

  • CursorSupported (announced)

    Published 4 Jun 2025 · last checked 9 Oct 2026: Cursor 1.0 changelog1.0 added OAuth support for MCP servers. The current docs (https://cursor.com/docs/context/mcp) say that when scopes are not configured, Cursor will 'use /.well-known/oauth-authorization-server to discover scopes_supported'.

  • CodexSupported (announced)

    Undated · last checked 9 Oct 2026: Codex: MCP (ChatGPT Learn)Lists 'OAuth authentication, including Client ID Metadata Documents (CIMD) and Dynamic Client Registration (DCR)' for Streamable HTTP servers. Codex picks CIMD when the authorization server metadata advertises client_id_metadata_document_supported, so it reads that metadata.

  • GitHub CopilotSupported (announced)

    Published 12 Jun 2025 · last checked 9 Oct 2026: VS Code May 2025 (v1.101) release notesVS Code, the host for GitHub Copilot agent mode, added MCP authorization for the 2025-03-26 spec and for the draft spec (MCP server as resource server), with dynamic client registration.

  • WindsurfSupported (announced)

    Published 12 Dec 2025 · last checked 9 Oct 2026: Windsurf / Devin Desktop changelogv1.12.44: 'Request all supported scopes if no scopes are provided in MCP OAuth config'. Later entries: 'Auto-trigger OAuth login when adding HTTP/SSE MCP servers'. windsurf.com/changelog now redirects to the Devin Desktop docs.

20 others: no evidence yet. See every agent and browser

What it checks

The extension looks for authorization server metadata at these paths, in order, and stops at the first that answers:

  1. /.well-known/oauth-authorization-server (RFC 8414)
  2. /.well-known/openid-configuration (OpenID Connect Discovery)

A path counts when it returns a successful, non-empty JSON response: the Content-Type mentions json, or the body starts with { or [. The fields inside are not validated.

Results

Status When
Pass Either path returns a JSON document
N/A Neither path returns a JSON document

How to fix

If your API is protected by OAuth, publish the authorization server’s metadata at /.well-known/oauth-authorization-server so an agent can find the endpoints it needs without being told:

{
  "issuer": "https://auth.example.com",
  "authorization_endpoint": "https://auth.example.com/authorize",
  "token_endpoint": "https://auth.example.com/token",
  "response_types_supported": ["code"]
}

Most identity providers already serve /.well-known/openid-configuration; the check finds it on the origin you scan, so it only passes if the metadata is on that origin.

Related: OAuth Protected Resource metadata.

Support by agent and browser

Announced means the vendor’s own docs or announcement say so. Published is the date on the vendor’s own page, where it has one. Checked is the last time our weekly research found that page still saying so.

AgentStatusSource
AI assistants
ChatGPT OpenAISupported (announced)

Apps SDK: Authentication Undated · Checked 'Your identity provider must expose one of the well-known discovery documents so ChatGPT can read its configuration' (OAuth 2.0 metadata or OpenID configuration).

Claude AnthropicSupported (announced)

Authentication for connectors (Claude docs) Undated · Checked Says the authorization server 'must serve its own discovery metadata, either RFC 8414 authorization server metadata or OpenID Connect Discovery 1.0, at its /.well-known/ paths'. Applies to claude.ai, Desktop, mobile, Claude Code and Cowork.

Coding agents
Claude Code AnthropicSupported (announced)

Claude Code CHANGELOG (v1.0.35) Published · Checked v1.0.35: 'Added support for MCP OAuth Authorization Server discovery'. Date is the npm release date.

Cursor AnysphereSupported (announced)

Cursor 1.0 changelog Published · Checked 1.0 added OAuth support for MCP servers. The current docs (https://cursor.com/docs/context/mcp) say that when scopes are not configured, Cursor will 'use /.well-known/oauth-authorization-server to discover scopes_supported'.

Codex OpenAISupported (announced)

Codex: MCP (ChatGPT Learn) Undated · Checked Lists 'OAuth authentication, including Client ID Metadata Documents (CIMD) and Dynamic Client Registration (DCR)' for Streamable HTTP servers. Codex picks CIMD when the authorization server metadata advertises client_id_metadata_document_supported, so it reads that metadata.

GitHub Copilot GitHubSupported (announced)

VS Code May 2025 (v1.101) release notes Published · Checked VS Code, the host for GitHub Copilot agent mode, added MCP authorization for the 2025-03-26 spec and for the draft spec (MCP server as resource server), with dynamic client registration.

Windsurf CognitionSupported (announced)

Windsurf / Devin Desktop changelog Published · Checked v1.12.44: 'Request all supported scopes if no scopes are provided in MCP OAuth config'. Later entries: 'Auto-trigger OAuth login when adding HTTP/SSE MCP servers'. windsurf.com/changelog now redirects to the Devin Desktop docs.

No evidence yet20
  • Gemini
  • Perplexity
  • Copilot
  • Meta AI
  • ChatGPT Atlas
  • Comet
  • Dia
  • Gemini in Chrome
  • Edge Copilot Mode
  • CCBot
  • Applebot
  • Amazonbot
  • Bytespider
  • Cohere
  • Mistral
  • DuckAssist
  • Chrome
  • Edge
  • Firefox
  • Safari

Names and marks belong to their owners and are used only to identify products. None of these vendors is affiliated with Sitebulb. Spotted something out of date? Send a correction.

Adoption on the top 100 sites

9 of 91 measured sites implement it

Scanned 23 Oct 2026 with the Sitebulb Labs extension, against the Tranco list (tranco-56Z8N). 9 sites couldn’t be measured (bot challenge or timeout) and are left out of the share.

9 Oct 2026: 10%12 Oct 2026: 10%23 Oct 2026: 10%
9 Oct 2026 10% → 23 Oct 2026 10%
Sites implementing it9
  1. #4 facebook.com
  2. #13 instagram.com
  3. #39 whatsapp.com (via whatsapp.net)
  4. #68 zoom.com (via zoom.us)
  5. #90 vimeo.com
  6. #103 reddit.com
  7. #106 sentry.io
  8. #132 dropbox.com
  9. #135 discord.com (via discord.gg)

Overview

7/9

Gaining traction

Real support exists and adoption is growing.

How this rating is worked out7 of 9 points
FactorPointsWhy
Vendor support3 / 35 vendors supporting, 0 partly or planned
Top-100 adoption1 / 310% of measured sites
Spec maturity3 / 3Published standard

8 or more points is Established, 5 to 7 is Gaining traction, 2 to 4 is Speculative and under 2 is Stalled. A feature is also Stalled when more vendors have said no than yes. Read the spec.

Community insights

No community insights for this feature yet.

Quotes are from public posts, checked against the original before they appear here. Suggest an insight, or ask for yours to be removed.