Sign in
latestOpenAPI 3.0.3GitGuardian2026-08-201871515.0 MB

511b067cdcb1

OAuth2

OAuth 2.0 Authorization Server Metadata.

OAuth 2.0 Authorization Server Metadata as defined by RFC 8414.

Used by OAuth 2.0 clients (notably MCP clients performing the Authorization Code + PKCE flow) to discover the URLs of the authorization, token, and dynamic client registration endpoints without out-of-band configuration. The endpoint is unauthenticated and exposes CORS so it can be fetched from browsers.

The registration_endpoint is only advertised when Dynamic Client Registration (RFC 7591) is enabled on this workspace.

get/.well-known/oauth-authorization-server

Response

Authorization server metadata document.

issuerstring uri required

URL identifying this authorization server.

authorization_endpointstring uri required

URL of the GitGuardian authorization endpoint (served by the GitGuardian dashboard, not the API).

token_endpointstring uri required

URL of the token endpoint.

registration_endpointstring uri

URL of the Dynamic Client Registration endpoint. Only present when DCR is enabled.

code_challenge_methods_supportedstring[] required

PKCE code challenge methods supported.

grant_types_supportedstring[] required
response_types_supportedstring[] required
scopes_supportedstring[] required

Scopes that may be requested by clients.

token_endpoint_auth_methods_supportedstring[] required

Client authentication methods supported at the token endpoint.

Example response

{
  "issuer": "https://api.gitguardian.com",
  "authorization_endpoint": "https://dashboard.gitguardian.com/auth/login",
  "token_endpoint": "https://api.gitguardian.com/v1/oauth/token",
  "registration_endpoint": "https://api.gitguardian.com/v1/oauth/register",
  "code_challenge_methods_supported": [
    "S256"
  ],
  "grant_types_supported": [
    "authorization_code"
  ],
  "response_types_supported": [
    "code"
  ],
  "scopes_supported": [
    "scan",
    "incidents:read",
    "incidents:write"
  ],
  "token_endpoint_auth_methods_supported": [
    "none",
    "client_secret_post"
  ]
}