Can an AI agent work out how to sign in to my service?
If your service lets other software sign in on a user's behalf with OAuth, this metadata is how that software learns the details: where to send the user, where to get a token, which methods you support. It is an IETF standard, RFC 8414. We check whether your domain publishes it.
What it actually is
It is the reception desk notice that says which door to use, which ID is accepted and where to collect a visitor badge. Instead of every developer copying your sign-in addresses out of your documentation, the details sit in one small JSON file that any OAuth client, including an AI agent, can read for itself.
Why it matters
An agent acting for a person has to sign in before it can do anything useful, and hard-coded sign-in details break the day you change them. Published metadata lets an agent connect to your service without a developer in the loop, which is what the newer agent standards, MCP authorisation among them, assume you have.
What good looks like
Metadata at the standard address on the domain that issues your tokens, naming an issuer that matches that domain and endpoints that actually answer, kept in step with your sign-in setup when it changes.
Being honest about it
This is an Advanced check, so it never fails a page and stays out of your headline score. It only applies if your service issues OAuth tokens to other software. A brochure site, a shop with an ordinary checkout or a blog has no reason to publish this, and a warning here is the expected result for them.
Where most sites go wrong
The usual surprise is a service whose sign-in runs on a separate identity provider, so the metadata lives on that provider's domain and the product's own domain has none. The other is metadata that lists endpoints from an old setup, so the software that reads it is sent somewhere that no longer works.
Not sure where yours stands?
A free scan checks this and everything else in about 20 seconds — no signup. Or if it's already flagged and you'd rather it were simply handled, we do that too.
Flagged for this one? We handle it. No pitch, just a plain-English chat.
Book a call