/.well-known/oauth-authorization-serverAuthorization-server metadata (RFC 8414)
FinRadar authorization-server metadata: `issuer`, `authorization_endpoint` (/oauth/authorize), `token_endpoint` (/oauth/token), `jwks_uri`, `code_challenge_methods_supported: ['S256']` (PKCE S256 required), `scopes_supported: ['mcp']`, `grant_types_supported: ['authorization_code','refresh_token']`, and support for HTTPS Client ID Metadata Documents plus issuer identification in authorization responses.
free
Response schema
| Field | Type | Nullable | Description |
|---|---|---|---|
| issuer | string | no | The authorization server's issuer identifier (no trailing slash). Every other endpoint URL below is this issuer plus a path, and issued tokens carry it as `iss`. |
| authorization_endpoint | string | no | URL of the authorize endpoint (`<issuer>/oauth/authorize`) where the user logs in and consents. |
| token_endpoint | string | no | URL of the token endpoint (`<issuer>/oauth/token`) that exchanges a code for a token and rotates refresh tokens. |
| jwks_uri | string | no | URL of the JSON Web Key Set (`<issuer>/.well-known/jwks.json`) — the public keys a resource server uses to verify access-token signatures. |
| registration_endpoint | string | no | URL of the Dynamic Client Registration endpoint (`<issuer>/oauth/register`, RFC 7591) where a client obtains a `client_id`. |
| client_id_metadata_document_supported | boolean | no | Always `true`. A supported client may use its trusted HTTPS metadata-document URL as `client_id`; FinRadar fetches, validates and briefly caches that document instead of requiring dynamic registration. |
| authorization_response_iss_parameter_supported | boolean | no | Always `true`. Successful and error authorization redirects include the exact FinRadar issuer in the `iss` query parameter so the client can reject an authorization response from another issuer. |
| revocation_endpoint | string | no | URL of the token revocation endpoint (`<issuer>/oauth/revoke`, RFC 7009) used to disconnect. |
| scopes_supported | array | no | The scope values the AS can grant: the `mcp` and `cli` superscopes plus the per-family `:read` grants and the reserved `account:write` / `payment:write`. Strings. |
| response_types_supported | array | no | OAuth response types supported. Always `['code']` — authorization-code flow only (OAuth 2.1; no implicit flow). |
| grant_types_supported | array | no | Grant types supported: `['authorization_code','refresh_token']`. |
| code_challenge_methods_supported | array | no | PKCE code-challenge methods. Always `['S256']` — `plain` is not accepted. |
| token_endpoint_auth_methods_supported | array | no | Client authentication methods at the token endpoint. Always `['none']` — public clients that authenticate with PKCE, no client secret. |
| service_documentation | string | no | URL of the canonical human/agent-readable service documentation (`https://api.finradar.ai/llms.txt` in production). This stays on the public documentation host when OAuth uses another approved issuer host. |
| op_tos_uri | string | yes | URL of the operator's Terms of Service. Present only when configured server-side; omitted otherwise (never advertised as a dead link). |
| op_policy_uri | string | yes | URL of the operator's usage policy. Present only when configured server-side; omitted otherwise. |
Errors
| Status | Label | Description |
|---|---|---|
| 200 | OK | Request succeeded. |
| 400 | Bad Request | Invalid query, body, or path parameter. |
| 401 | Unauthorized | Missing or invalid Authorization header / api_Token. |
| 402 | Payment Required | Insufficient token balance for this call. Top up |
| 429 | Too Many Requests | Rate limit exceeded for your tier (see /pricing for tier limits). Tier limits |
| 500 | Server Error | Unexpected server-side failure. Retry with backoff; report if persistent. |
Code samples
curl "https://api.finradar.ai/.well-known/oauth-authorization-server" \
-H "X-API-Key: YOUR_API_KEY"Generate an API key in /account/credentials to run live queries (literal YOUR_API_KEY placeholder shown until then).