Skip to main content
GET
Authorization server metadata

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-Request-Id
string

Optional client correlation id, up to 128 characters. It is not echoed: the response's X-Request-Id is always our own req_… id. We log your value with the request as client_request_id, so support can find a request by either id. A longer value is refused with 400 parameter_invalid.

Maximum string length: 128

Response

Metadata.

RFC 8414 metadata. MCP clients find it from the MCP server's protected-resource metadata (https://mcp.panoflow.io/.well-known/oauth-protected-resource, see mcp/README.md).

issuer
string<uri>
required

Issuer identifier.

authorization_endpoint
string<uri>
required

Consent page in the web app.

token_endpoint
string<uri>
required

Token endpoint.

response_types_supported
enum<string>[]
required

Only code.

Available options:
code
grant_types_supported
enum<string>[]
required

Supported grants.

Available options:
authorization_code,
refresh_token
code_challenge_methods_supported
enum<string>[]
required

Only S256; plain is refused.

Available options:
S256
revocation_endpoint
string<uri>

RFC 7009 revocation.

registration_endpoint
string<uri>

RFC 7591 dynamic client registration.

scopes_supported
enum<string>[]

Scopes a client may request.

An OAuth scope an agent may be granted. Only these seven exist for agents (CONVENTIONS §10): agent tokens can never hold api_keys:*, team:*, agents:*, payroll:* or any scope that changes limits, allowlists or scopes.

Available options:
accounts:read,
transfers:read,
transfers:write,
recipients:read,
recipients:write,
collections:read,
collections:write
response_modes_supported
enum<string>[]

Only query.

Available options:
query
token_endpoint_auth_methods_supported
enum<string>[]

Public clients only (none); PKCE replaces the secret.

Available options:
none
revocation_endpoint_auth_methods_supported
enum<string>[]

As for the token endpoint.

Available options:
none
service_documentation
string<uri>

Docs.