{
  "issuer": "https://auth.callsign.sh/auth/v1",
  "authorization_endpoint": "https://auth.callsign.sh/auth/v1/oauth/authorize",
  "token_endpoint": "https://auth.callsign.sh/auth/v1/oauth/token",
  "jwks_uri": "https://auth.callsign.sh/auth/v1/.well-known/jwks.json",
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "code_challenge_methods_supported": ["S256"],
  "token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post", "none"],
  "service_documentation": "https://callsign.sh/docs",
  "op_policy_uri": "https://callsign.sh/docs",
  "op_tos_uri": "https://callsign.sh/docs",
  "issuer_description": "Callsign delegates OAuth 2.1 to Supabase Auth (Dynamic Client Registration enabled). This is an advisory copy; the authoritative, environment-resolved pointer is served at https://api.callsign.sh/.well-known/oauth-protected-resource and redirects to the Supabase RFC 8414 discovery document. The issuer above assumes the Supabase custom domain auth.callsign.sh; substitute the project's <ref>.supabase.co/auth/v1 issuer if no custom domain is configured."
}