curl --fail-with-body --max-time 30 'https://app.reflections.ai/.well-known/oauth-authorization-server'import { exit } from "node:process";
const response = await fetch("https://app.reflections.ai/.well-known/oauth-authorization-server", {
method: "GET",
headers: {
},
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
from urllib.error import HTTPError
from urllib.request import Request, urlopen
headers = {
}
request = Request("https://app.reflections.ai/.well-known/oauth-authorization-server",
method="GET", headers=headers)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"time"
)
func main() {
request, err := http.NewRequest("GET", "https://app.reflections.ai/.well-known/oauth-authorization-server", nil)
if err != nil {
panic(err)
}
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"issuer": "https://app.reflections.ai",
"authorization_endpoint": "https://app.reflections.ai/oauth/authorize",
"token_endpoint": "https://app.reflections.ai/oauth/token",
"registration_endpoint": "https://app.reflections.ai/oauth/register",
"introspection_endpoint": "https://app.reflections.ai/oauth/introspect",
"revocation_endpoint": "https://app.reflections.ai/oauth/revoke",
"scopes_supported": [
"talent:read",
"licenses:read",
"license_requests:write",
"files:write",
"checks:write",
"generations:write",
"sessions:write",
"revocations:write",
"usage:write",
"statements:read"
],
"response_types_supported": [
"code"
],
"response_modes_supported": [
"query"
],
"grant_types_supported": [
"authorization_code",
"refresh_token",
"client_credentials"
],
"token_endpoint_auth_methods_supported": [
"none",
"client_secret_basic",
"client_secret_post"
],
"introspection_endpoint_auth_methods_supported": [
"client_secret_basic",
"client_secret_post"
],
"revocation_endpoint_auth_methods_supported": [
"none",
"client_secret_basic",
"client_secret_post"
],
"code_challenge_methods_supported": [
"S256"
],
"authorization_response_iss_parameter_supported": true,
"client_id_metadata_document_supported": true,
"service_documentation": "https://docs.reflections.ai/api-reference/authentication"
}{
"type": "https://docs.reflections.ai/errors/rate_limited",
"title": "Too many requests",
"status": 429,
"code": "rate_limited",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}Retrieve the authorization server metadata
Planned contract — unavailable in test and live modes. This operation is a protocol reference, not a callable endpoint. Start with the working sandbox quickstart.
Describes the OAuth endpoints, grants and scopes, as OAuth Authorization Server Metadata
(RFC 8414) defines. MCP clients and OAuth libraries read it instead of hard-coding URLs.
Public, and served with Cache-Control: public, max-age=3600.
curl --fail-with-body --max-time 30 'https://app.reflections.ai/.well-known/oauth-authorization-server'import { exit } from "node:process";
const response = await fetch("https://app.reflections.ai/.well-known/oauth-authorization-server", {
method: "GET",
headers: {
},
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
from urllib.error import HTTPError
from urllib.request import Request, urlopen
headers = {
}
request = Request("https://app.reflections.ai/.well-known/oauth-authorization-server",
method="GET", headers=headers)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"time"
)
func main() {
request, err := http.NewRequest("GET", "https://app.reflections.ai/.well-known/oauth-authorization-server", nil)
if err != nil {
panic(err)
}
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"issuer": "https://app.reflections.ai",
"authorization_endpoint": "https://app.reflections.ai/oauth/authorize",
"token_endpoint": "https://app.reflections.ai/oauth/token",
"registration_endpoint": "https://app.reflections.ai/oauth/register",
"introspection_endpoint": "https://app.reflections.ai/oauth/introspect",
"revocation_endpoint": "https://app.reflections.ai/oauth/revoke",
"scopes_supported": [
"talent:read",
"licenses:read",
"license_requests:write",
"files:write",
"checks:write",
"generations:write",
"sessions:write",
"revocations:write",
"usage:write",
"statements:read"
],
"response_types_supported": [
"code"
],
"response_modes_supported": [
"query"
],
"grant_types_supported": [
"authorization_code",
"refresh_token",
"client_credentials"
],
"token_endpoint_auth_methods_supported": [
"none",
"client_secret_basic",
"client_secret_post"
],
"introspection_endpoint_auth_methods_supported": [
"client_secret_basic",
"client_secret_post"
],
"revocation_endpoint_auth_methods_supported": [
"none",
"client_secret_basic",
"client_secret_post"
],
"code_challenge_methods_supported": [
"S256"
],
"authorization_response_iss_parameter_supported": true,
"client_id_metadata_document_supported": true,
"service_documentation": "https://docs.reflections.ai/api-reference/authentication"
}{
"type": "https://docs.reflections.ai/errors/rate_limited",
"title": "Too many requests",
"status": 429,
"code": "rate_limited",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}Response
The authorization server metadata.
OAuth authorization server metadata, as RFC 8414 defines it.
The issuer, https://app.reflections.ai. It equals the iss on every authorization response.
The authorization page.
The token endpoint.
Always ["code"].
The grants the token endpoint accepts.
Always ["S256"].
The client registration endpoint.
The introspection endpoint, for RSL content hosts.
The revocation endpoint.
Every scope a client may ask for.
A scope a person can approve. Connections use all ten. The MCP server accepts
talent:read, licenses:read, checks:write, generations:write,
license_requests:write and usage:write.
talent:read, licenses:read, license_requests:write, files:write, checks:write, generations:write, sessions:write, revocations:write, usage:write, statements:read Always ["query"].
How clients authenticate at the token endpoint.
How clients authenticate at the introspection endpoint.
How clients authenticate at the revocation endpoint.
true: every authorization response carries iss (RFC 9207).
true: a client may use the HTTPS URL of its metadata document as its client_id.
These docs.