{
  "issuer": "https://whos-in.app",
  "authorization_endpoint": "https://whos-in.app/login",
  "token_endpoint": "https://securetoken.googleapis.com/v1/token",
  "jwks_uri": "https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com",
  "response_types_supported": ["token", "id_token"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "token_endpoint_auth_methods_supported": ["client_secret_post", "client_secret_basic"],
  "scopes_supported": ["openid", "email", "profile"],
  "code_challenge_methods_supported": ["S256"],
  "agent_auth": {
    "skill": "https://whos-in.app/auth.md",
    "register_uri": "https://whos-in.app/api-docs",
    "identity_types_supported": ["anonymous"],
    "claim_uri": "https://whos-in.app/api-docs",
    "anonymous": {
      "credential_types_supported": ["bearer_token"],
      "claim_uri": "https://whos-in.app/api-docs"
    },
    "credential_types": ["bearer_token"],
    "revocation_uri": "mailto:api@whos-in.app?subject=Revoke%20agent%20OAuth%20client",
    "registration_methods": [
      {
        "type": "manual_provisioning",
        "register_uri": "mailto:api@whos-in.app?subject=Agent%20OAuth%20client%20registration",
        "grant_types": ["authorization_code", "refresh_token"],
        "code_challenge_methods": ["S256"],
        "scopes_supported": ["read:events", "read:attendees"],
        "description": "Email api@whos-in.app to provision an OAuth client (client_id, plus client_secret for confidential clients) for scoped agent access. Automated dynamic client registration is on the roadmap."
      }
    ]
  },
  "_note": "RFC 8414 §3.3: the issuer identifier MUST match the origin this metadata is served from (https://whos-in.app), so the protected-resource -> authorization-server discovery chain validates. Underlying tokens are minted by Firebase Authentication (token_endpoint + jwks_uri point at Google's securetoken service); the separate /.well-known/openid-configuration mirrors the raw Firebase OIDC issuer. Agent-facing OAuth is not yet enabled — this endpoint exists for discoverability. Contact: api@whos-in.app",
  "contact": "api@whos-in.app"
}