ARO · Operational

OAuth discovery

OAuth discovery is an Agent Readiness Optimization check in the Auth and trust group.

Version agent-readiness-2026-10

What is this benchmark?

OAuth discovery is an Agent Readiness Optimization check in the Auth and trust group.

Why it matters

OAuth metadata tells an agent where to authorize.

How SiteGlue evaluates it

HTTP request to a well-known or published URL. Spec: https://www.rfc-editor.org/rfc/rfc8414. Catalog agent-readiness-2026-10.

Passing criteria: The published signal for OAuth discovery is present and readable.
Failing criteria: The scan requested the signal and it was missing, blocked, or malformed.
Not verified: The check was not selected, the probe did not run, or evidence was inconclusive. Not verified is never scored as 0.
Not applicable: Not applicable when the business has no corresponding surface (for example commerce protocols on a site with no cart).

Scoring weight: 1. Evidence: Public HTTP, HTML, or DNS evidence for OAuth discovery. No private credentials.

Example results

Pass

Agents can read a valid OAuth discovery signal on the public site.

Fail

OAuth discovery is missing, blocked, or not machine-readable.

Recommended fixes

Publish the OAuth authorization-server metadata for the API this project actually protects.

Related benchmarks

Frequently asked questions

Does a missing optional check lower my ARO score?

Yes, if the check is applicable and failed. Not verified items are excluded.

No. ARO is a website audit. Optional live walks are Test With AI Agents.