Oauth discovery

Skill whiteknightonhorse/aipush-agent-skills/skills/oauth-discovery

Free, open, security-verified agent skills for AEO (Answer Engine Optimization) — make any site ready for AI agents. Live: aipush.app

Install

npx -y skills add whiteknightonhorse/aipush-agent-skills --skill oauth-discovery

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.4 KB, 332 tokens by cl100k_base, as published. Nobody here has run it

Publish OAuth/OIDC discovery metadata

AIPUSH agent skill · Category: Identity & Auth · Slug: oauth-discovery

Discovery metadata lets agents learn programmatically how to authenticate with your protected APIs — endpoints, supported grants, and key material — without hardcoding.

Why it matters

Discovery metadata lets agents learn programmatically how to authenticate with your protected APIs — endpoints, supported grants, and key material — without hardcoding.

How to detect

Request /.well-known/openid-configuration (OIDC) or /.well-known/oauth-authorization-server (OAuth 2.0).

How to implement

If you have protected APIs, publish discovery metadata:

{
  "issuer": "https://YOURDOMAIN",
  "authorization_endpoint": "https://YOURDOMAIN/oauth/authorize",
  "token_endpoint": "https://YOURDOMAIN/oauth/token",
  "jwks_uri": "https://YOURDOMAIN/.well-known/jwks.json",
  "grant_types_supported": ["authorization_code", "client_credentials"],
  "response_types_supported": ["code"]
}

How to verify

curl -s https://YOURDOMAIN/.well-known/openid-configuration | jq .token_endpoint returns your endpoint.

References

Part of the AIPUSH agent skills catalog. Scan your site free at https://aipush.app.

Gives 0 of the 12 instructions most auth identity skills give in 332 tokens

Counted across 409 of the 410 authors here whose files we hold, read 2026-08-06

hash passwords with bcrypt or argon2in 53 of 409, across 43 files
use parameterized queriesin 47 of 409, across 39 files
load SECRET_KEY from environment variablesin 23 of 409, across 14 files
validate all input server-sidein 19 of 409, across 11 files
refresh access tokens before expiryin 17 of 409, across 9 files
store tokens in httponly cookiesin 17 of 409, across 16 files
store refresh tokens securelyin 16 of 409, across 6 files
validate webhook signatures before processingin 15 of 409, across 5 files
sanitize user inputsin 15 of 409, across 9 files
implement rate limiting on auth endpointsin 14 of 409, across 9 files
encrypt sensitive data at restin 13 of 409, across 10 files
validate uploaded file extensions and sizesin 12 of 409, across 5 files

Said here and by no other author read

Request OIDC discovery metadata from the well-known endpoint
Publish discovery metadata for protected APIs
Verify token endpoint using curl and jq

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.