Authorization Server Metadata

A well-known JSON document that lists an authorization server's endpoints and capabilities.

Where it stands: Published RFC
Official text: RFC 8414
Documented support: 2
Activity: 0

No explainer written for this spec yet. The summary, relations and documented support below are maintained.

A well-known JSON document that lists an authorization server's endpoints and capabilities.

How it relates to other specs

Relations diagram

flowchart LR
  s_as_metadata["Authorization Server Metadata"]
  s_oauth2["OAuth 2.0"]
  s_prm["Protected Resource Metadata"]
  s_rar_metadata_remediation["RAR Metadata and Error Remediation"]
  style s_as_metadata stroke-width:3px
  s_as_metadata -->|Extends| s_oauth2
  s_prm -->|Works with| s_as_metadata
  s_rar_metadata_remediation -->|Works with| s_as_metadata

Documented support

Adoption lists only support stated in official documentation (the vendor's or project's own, or a standards body's page naming it), and a weekly check confirms the cited phrase is still on that page. Experimental, alpha and beta support is counted separately as preview.

Products, identity providers and services

Model Context Protocol (Specification): MCP authorization spec uses RFC 8414 Authorization Server Metadata, with path insertion source (verified 2026-11-11)
Keycloak (Identity provider): Keycloak's MCP compliance table lists RFC 8414 as Supported source (verified 2026-11-11)

Activity

Revisions from the Datatracker, explanations from this site's daily runs, and mailing-list subjects naming the draft.

Nothing collected about this spec yet.