# description
GET /.well-known/oauth-authorization-server — RFC 8414 discovery document for MailKite's authorization server. Read the endpoints from here rather than hard-coding them. Also served at /.well-known/openid-configuration for clients that probe OIDC discovery.

# properties.authorization_endpoint.description
Where to send the user's browser to sign in and consent.

# properties.token_endpoint.description
Where to exchange the authorization code (or a refresh token) for an access token.

# properties.registration_endpoint.description
RFC 7591 dynamic client registration — no pre-shared client secret needed.

# properties.scopes_supported.description
Scopes this server issues. A single scope today — the token it returns acts on the whole account, so exchange it once for an API key and discard it rather than storing it long-term.

# properties.code_challenge_methods_supported.description
PKCE is mandatory, S256 only — a plain challenge is rejected.

# properties.token_endpoint_auth_methods_supported.description
`none` — clients are public and authenticate with PKCE, not a secret.