Add support for the OAuth2 .well-known discovery endpoints, so clients can find our authorization and token URLs automatically instead of hard-coding them.
/.well-known/oauth-authorization-server — authorization server metadata (RFC 8414): issuer, authorization_endpoint, token_endpoint, supported grant types, response types, and PKCE methods./.well-known/oauth-protected-resource — protected resource metadata (RFC 9728): resource identifier and linked authorization servers.
humanmade/hm-rest-ability already has a working version of this at inc/oauth2-discovery.php. It hooks parse_request to serve both JSON documents, and already points at this plugin's own routes (oauth2/authorize, oauth2/access_token), so it should port across with only small changes:
- Drop the MCP-specific bits (the
WWW-Authenticate header added only for /mcp/ REST routes, and the Require Login exemption written for that plugin).
- Keep the two
hm_oauth2_discovery_metadata / hm_oauth2_protected_resource_metadata filters, so sites can adjust the metadata.
- Add PHPUnit coverage (that repo has
tests/phpunit/OAuth2DiscoveryTest.php as a reference).
This makes the plugin discoverable by OAuth2/OIDC clients and MCP clients without extra config.
Add support for the OAuth2
.well-knowndiscovery endpoints, so clients can find our authorization and token URLs automatically instead of hard-coding them./.well-known/oauth-authorization-server— authorization server metadata (RFC 8414): issuer,authorization_endpoint,token_endpoint, supported grant types, response types, and PKCE methods./.well-known/oauth-protected-resource— protected resource metadata (RFC 9728): resource identifier and linked authorization servers.humanmade/hm-rest-abilityalready has a working version of this atinc/oauth2-discovery.php. It hooksparse_requestto serve both JSON documents, and already points at this plugin's own routes (oauth2/authorize,oauth2/access_token), so it should port across with only small changes:WWW-Authenticateheader added only for/mcp/REST routes, and the Require Login exemption written for that plugin).hm_oauth2_discovery_metadata/hm_oauth2_protected_resource_metadatafilters, so sites can adjust the metadata.tests/phpunit/OAuth2DiscoveryTest.phpas a reference).This makes the plugin discoverable by OAuth2/OIDC clients and MCP clients without extra config.