generated: '2026-08-12'
method: probed
source: https://eatstreet.com/.well-known/oauth-authorization-server
name: EatStreet authentication profile
description: >-
  EatStreet publishes an RFC 8414 OAuth 2.0 Authorization Server Metadata
  document at https://eatstreet.com/.well-known/oauth-authorization-server. It
  is the only machine-readable contract EatStreet currently serves: the public
  developer portal at developers.eatstreet.com returns 404 and no OpenAPI,
  GraphQL SDL or MCP manifest was found on any host. Everything below is read
  verbatim from that metadata document and from live unauthenticated responses
  from the token endpoint — nothing here is inferred from documentation,
  because EatStreet publishes none.
schemes:
- id: oauth2_authorization_code
  type: oauth2
  flow: authorization_code
  issuer: https://eatstreet.com
  authorization_endpoint: https://eatstreet.com/authorize
  token_endpoint: https://eatstreet.com/api/v2/oauth/token
  introspection_endpoint: https://eatstreet.com/api/v2/oauth/introspect
  revocation_endpoint: https://eatstreet.com/api/v2/oauth/revoke
  jwks_uri: https://eatstreet.com/.well-known/jwks.json
  grant_types_supported:
  - authorization_code
  response_types_supported:
  - code
  - token
  response_modes_supported:
  - query
  pkce:
    supported: true
    code_challenge_methods:
    - plain
    - S256
  client_authentication:
    token_endpoint:
    - client_secret_basic
    - client_secret_post
    introspection_endpoint:
    - client_secret_basic
    - client_secret_post
    revocation_endpoint:
    - client_secret_basic
    - client_secret_post
  scopes:
  - merchant_integration
  - customer
  - example
  ui_locales_supported:
  - en-US
observations:
- endpoint: https://eatstreet.com/api/v2/oauth/token
  method: POST
  request: grant_type=authorization_code (no client credentials)
  http_status: 401
  body: '{"error":"invalid_client","error_description":"client_id is missing"}'
  note: >-
    Live, unauthenticated probe. Confirms the endpoint is active and returns
    RFC 6749 section 5.2 error codes.
- endpoint: https://eatstreet.com/api/v2/oauth/token
  method: GET
  http_status: 405
  body: '{"error":{"message":"This HTTP Method was rejected","code":400}}'
- endpoint: https://eatstreet.com/authorize
  method: GET
  http_status: 302
  note: Redirects (no client_id supplied).
gaps:
- >-
  No OpenID Connect. /.well-known/openid-configuration returns the SPA shell, and
  the authorization server metadata declares no id_token support or userinfo endpoint.
- >-
  No RFC 9728 protected-resource metadata, so an agent cannot discover which
  resource server the tokens are for without out-of-band knowledge.
- >-
  No client_credentials grant is advertised, so there is no server-to-server flow
  without a user authorization step.
- >-
  No public documentation of how to register a client or obtain credentials; the
  developer portal named by the GitHub organization (developers.eatstreet.com)
  returns 404.
docs: null
x-evidence:
  fetched: '2026-08-12'
  url: https://eatstreet.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json;charset=UTF-8