PandaIDX

Authorization Server Metadata

RFC 8414 discovery document. It lists the authorize, token, revoke and register endpoints, the supported scopes and the PKCE method. MCP clients read it automatically; read it yourself to avoid hardcoding URLs.

GET/.well-known/oauth-authorization-server

Authentication

Noneno credentials

Public, no authentication.

Responses

200Success
application/json
issuerstring
authorization_endpointstring
token_endpointstring
revocation_endpointstring
registration_endpointstring
scopes_supportedarray[string]
response_types_supportedarray[string]
grant_types_supportedarray[string]
code_challenge_methods_supportedarray[string]
token_endpoint_auth_methods_supportedarray[string]
client_id_metadata_document_supportedboolean
resource_parameter_supportedboolean
Request
curl "https://api.pandaidx.com/.well-known/oauth-authorization-server"
Response200 OK
{
  "issuer": "https://app.pandaidx.com",
  "authorization_endpoint": "https://app.pandaidx.com/authorize",
  "token_endpoint": "https://app.pandaidx.com/api/oauth/token",
  "revocation_endpoint": "https://app.pandaidx.com/api/oauth/revoke",
  "registration_endpoint": "https://api.pandaidx.com/register",
  "scopes_supported": [
    "profile",
    "listings",
    "contacts",
    "analytics",
    "calendar",
    "collections",
    "saved_searches",
    "email",
    "builder"
  ],
  "response_types_supported": [
    "code"
  ],
  "grant_types_supported": [
    "authorization_code",
    "refresh_token"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "token_endpoint_auth_methods_supported": [
    "none",
    "client_secret_post",
    "client_secret_basic"
  ],
  "client_id_metadata_document_supported": true,
  "resource_parameter_supported": true
}