jamietannajacky re OAuth2 metadata endpoint, I know of more folks exposing an OpenID Connect discovery endpoint (https://openid.net/specs/openid-connect-discovery-1_0.html) - I'm planning on doing both at some point to make it easier to autoconfigure i.e. security libraries