Free tool · no signup · runs now
OAuth discovery checker
Agents find your token endpoints through discovery metadata, not docs pages. The checker reads the same documents the audit requires.
Part of the AI agent trust checker group — also included in the free full scan.
Checks site-wide files at the domain root — any page URL on the domain gives the same result.
One free scan · anonymous preview · sign in to save the full report
issuer: https://auth.example.comStatic example for OAuth discovery checker; run the check above for your own result.What it checks
See whether agents can discover your OAuth endpoints from well-known metadata.
openid-configuration and oauth-authorization-server paths, issuer plus endpoints plus response_types fields.
Reads the raw JSON only, never renders. Follows up to 5 redirects.
What good looks like
Good looks like a discovery document with issuer, endpoints, response_types and jwks_uri all present — agents find token endpoints from metadata, not docs pages. Missing fields fail with their names; no document reports na.
How to fix it
Serve /.well-known/oauth-authorization-server with issuer, endpoints, response_types and jwks_uri.
What the full scan adds
- All 34 checks in one pass — one URL, every category, a single report.
- Evidence on every row: the values found, why it fails, the fix, and a deep link per check.
- Your score against the global distribution — see where you stand.
- Sign in and the report is kept for 1 year; anonymous reports expire after 7 days.
Official source: RFC 8414, OAuth authorization server metadata · Rule: agent-readiness v1 · checker library
Tracking a Google update? Run the update impact check or read the search update radar.
Frequently asked questions
Is the OAuth discovery checker free?
Yes — one free run without an account, with an anonymous preview. Sign in to save the full report and keep the evidence.
How often should I run it?
After every deploy that touches routing, templates or the checked file — and after each Google core update, to confirm nothing regressed.
Does the check run JavaScript?
No — it reads the no-JS response only, exactly what a crawler or AI agent sees when it fetches the URL.
How is this different from a full audit?
This page runs one check with its full criteria and fix notes. The free full scan runs every category at once and keeps the evidence per URL — use it once you know which checks matter.