> ## Documentation Index
> Fetch the complete documentation index at: https://docs.factorize.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth discovery

> Endpoints and metadata for OAuth-aware clients.

At the deployment origin, clients can retrieve:

* `/.well-known/oauth-authorization-server` — issuer, authorization, token, registration, revocation, and device endpoints plus supported grants/scopes.
* `/.well-known/oauth-protected-resource` — resource `APP_ORIGIN/mcp`, authorization server, header bearer authentication, and supported scopes.

The authorization endpoint is `/authorize`, token endpoint `/oauth/token`, dynamic registration endpoint `/oauth/register`, and device endpoint `/oauth/device_authorization`. Client ID Metadata Documents are enabled. MCP clients should use `APP_ORIGIN/mcp`; they can discover OAuth automatically and complete browser PKCE consent.