> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.voicecheap.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Get authorization-server metadata

> Discover the public OAuth endpoints and authorization-code, PKCE, refresh, and revocation mechanisms supported by this environment.

Discover the public OAuth endpoints and authorization-code, PKCE, refresh, and revocation mechanisms supported by this environment.

```http theme={null}
GET https://api.voicecheap.ai/.well-known/oauth-authorization-server
```

## Authentication

None.

## Request examples

Follow the documented encoding and authentication for this route. The action API's envelope and idempotency rules apply only to action invocations.

<RequestExample>
  ```bash cURL theme={null}
  curl --request GET 'https://api.voicecheap.ai/.well-known/oauth-authorization-server'
  ```

  ```javascript JavaScript theme={null}
  const input = {};
  const response = await fetch('https://api.voicecheap.ai/.well-known/oauth-authorization-server', {
    method: 'GET',
    headers: {},
    redirect: 'manual',
  });
  console.log(response.status, await response.text());
  ```

  ```python Python theme={null}
  import os
  import requests

  response = requests.request(
      "GET",
      "https://api.voicecheap.ai/.well-known/oauth-authorization-server",
      headers={},
      timeout=120,
      allow_redirects=False,
  )
  print(response.status_code, response.text)
  ```
</RequestExample>

## Response

OAuth authorization-server metadata with absolute endpoint URLs on the canonical issuer origin.

```json HTTP 200 theme={null}
{
  "issuer": "https://api.voicecheap.ai",
  "authorization_endpoint": "https://api.voicecheap.ai/oauth/authorize",
  "token_endpoint": "https://api.voicecheap.ai/oauth/token",
  "registration_endpoint": "https://api.voicecheap.ai/oauth/register",
  "revocation_endpoint": "https://api.voicecheap.ai/oauth/revoke",
  "response_types_supported": ["code"],
  "response_modes_supported": ["query"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "token_endpoint_auth_methods_supported": ["none"],
  "revocation_endpoint_auth_methods_supported": ["none"],
  "code_challenge_methods_supported": ["S256"],
  "scopes_supported": [
    "account:read",
    "usage:read",
    "settings:read",
    "settings:write",
    "team:read",
    "team:write",
    "projects:read",
    "projects:write",
    "projects:delete",
    "translations:write",
    "transcription:read",
    "transcription:write",
    "subtitles:read",
    "subtitles:write",
    "tts:read",
    "tts:write",
    "voices:read",
    "voices:write",
    "images:read",
    "images:write",
    "thumbnails:read",
    "thumbnails:write",
    "folders:read",
    "folders:write",
    "glossary:read",
    "glossary:write",
    "webhooks:read",
    "webhooks:write",
    "publishing:read",
    "publishing:write",
    "offline_access"
  ],
  "authorization_response_iss_parameter_supported": true,
  "client_id_metadata_document_supported": true
}
```

## Operation notes

* Only the code response type and query response mode are advertised.
* Clients can use dynamic registration or a Client ID Metadata Document (CIMD). client\_id\_metadata\_document\_supported is true; a CIMD client uses its public HTTPS document URL as client\_id.
* A CIMD JSON document must contain an exact matching client\_id, a nonempty client\_name of at most 120 characters, and 1–10 exact redirect\_uris. Use public-client authentication none with S256 PKCE; authorization\_code is required and refresh\_token is optional.
* Serve CIMD as uncompressed JSON over public HTTPS on port 443, with an explicit path, without credentials, fragments, dot segments, or redirects. The document must be at most 64 KiB and respond within 5 seconds. Cached metadata expires within 5 minutes; token exchange and refresh use the metadata bound to the grant.
* When OpenID Connect is available, authorization-server metadata also advertises openid and email scopes, userinfo\_endpoint, and jwks\_uri. Otherwise these scopes and endpoints are absent from that metadata.
* Token and revocation authentication methods are none. Public clients use client\_id and S256 PKCE instead of a client secret.
* offline\_access is a renewal-related scope marker, not a product permission. Issuing a refresh token depends on whether refresh\_token was registered as a grant type.
* Check the returned iss value on the final client callback against issuer. Both successful and denied authorization callbacks include iss, and echo state when one was supplied.

## Errors

| HTTP status | Code | Meaning or recovery |
| - | - | - |
| 429 | `temporarily_unavailable` | The public OAuth request rate limit was reached. Wait for the current window before retrying. |
| 500 | `server_error` | Authorization is temporarily unavailable. Retry later. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.