Authentication metadata
How software finds out whether it needs credentials and where it would get them.
- What the test asks for
- We request
/.well-known/oauth-protected-resourceon your domain over the network, exactly the way an outside client would, and read what comes back. A setting that is switched on but unreachable is not a pass. - Can QWeb Agent Ready add it for me?
- Yes. The free plugin publishes this. RFC 9728 protected resource metadata, RFC 8414 authorization server metadata, and a readable auth.md alongside.
- How settled is this?
- A published standard.
Does your site pass this one?
The free test checks it against your live URL, along with 18 others, and tells you how many the free plugin can fix.