> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goatpay.com.br/llms.txt
> Use this file to discover all available pages before exploring further.

# Metadados OAuth

> Descoberta automática do Authorization Server (RFC 8414).

<RequestExample>
  ```bash cURL theme={null}
  curl https://api.goatpay.com.br/.well-known/oauth-authorization-server
  ```
</RequestExample>

<ResponseExample>
  ```json Success theme={null}
  {
    "issuer": "https://api.goatpay.com.br",
    "authorization_endpoint": "https://api.goatpay.com.br/oauth/authorize",
    "token_endpoint": "https://api.goatpay.com.br/oauth/token",
    "revocation_endpoint": "https://api.goatpay.com.br/oauth/revoke",
    "response_types_supported": ["code"],
    "grant_types_supported": ["authorization_code", "refresh_token"],
    "code_challenge_methods_supported": ["S256"],
    "token_endpoint_auth_methods_supported": ["client_secret_post", "client_secret_basic"],
    "scopes_supported": [
      "account:read",
      "account:write",
      "transactions:read",
      "transactions:write",
      "payments:read",
      "payments:write",
      "withdrawals:read",
      "withdrawals:create",
      "webhooks:read",
      "webhooks:write"
    ]
  }
  ```
</ResponseExample>

<Note>
  Este endpoint fica na **raiz** da API (`https://api.goatpay.com.br`), fora do prefixo `/v1`. Não requer autenticação.
</Note>


## OpenAPI

````yaml GET /.well-known/oauth-authorization-server
openapi: 3.1.0
info:
  title: GoatPay API
  description: >
    API pública merchant da GoatPay. Autenticação via header `X-API-Key:
    gp_live_...`.

    Respostas de sucesso usam o envelope `{ success, message, data, requestId
    }`.

    Campos internos (`accountId`, `metadata`, histórico de entregas de webhook,
    etc.) não são expostos.

    `providerTransactionId` aparece como `referenceId`; `providerInfractionId`
    como `infractionId`.

    Rate limit global: 100 requisições por minuto por API key (HTTP 429). Sem
    chave, limite por IP.
  version: 1.0.0
servers:
  - url: https://api.goatpay.com.br/v1
    description: Produção
security:
  - apiKeyAuth: []
tags:
  - name: pix
    description: >-
      Cobranças PIX (receber), reembolsos de depósito recebido e transferências
      PIX (enviar). Alias legado em payouts/* para envios.
  - name: transfer-internal
    description: Transferências entre contas GoatPay
  - name: transfer-scheduled
    description: Transferências programadas (agendar, repetir ou por saldo)
  - name: crypto
    description: Depósitos e transferências em criptomoeda
  - name: billings
    description: >-
      Cobranças avulsas (pagamento único) — boleto, cartão ou PIX na Conta
      Padrão (PF ou PJ)
  - name: subscriptions
    description: >-
      Assinaturas recorrentes com ciclo fixo — boleto, cartão ou PIX na Conta
      Padrão (PF ou PJ)
  - name: account
    description: Saldo e extrato
  - name: subaccount
    description: Subcontas merchant (carteiras lógicas sob a conta principal)
  - name: meds
    description: Disputas MED
  - name: webhooks
    description: Endpoints de webhook de saída
  - name: oauth
    description: OAuth 2.0 — autorização de terceiros (fora do prefixo /v1)
  - name: oauth-apps
    description: Gestão de aplicações OAuth (prefixo /v1, API key)
  - name: payouts
    description: Alias de transfer-pix para saques PIX
  - name: customers
    description: Clientes da loja (CRM)
  - name: products
    description: Produtos e entregas digitais
  - name: coupons
    description: Cupons de desconto para links
  - name: payment-links
    description: Links de pagamento e checkout hospedado
paths:
  /.well-known/oauth-authorization-server:
    get:
      tags:
        - oauth
      summary: Metadados do Authorization Server
      description: Descoberta automática RFC 8414 — URLs de authorize, token e revoke.
      operationId: getOAuthAuthorizationServerMetadata
      responses:
        '200':
          $ref: '#/components/responses/OAuthAuthorizationServerMetadataSuccess'
      security: []
      servers:
        - url: https://api.goatpay.com.br
          description: Raiz da API (sem /v1)
components:
  responses:
    OAuthAuthorizationServerMetadataSuccess:
      description: Metadados do provedor OAuth.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/OAuthAuthorizationServerMetadata'
          examples:
            default:
              value:
                issuer: https://api.goatpay.com.br
                authorization_endpoint: https://api.goatpay.com.br/oauth/authorize
                token_endpoint: https://api.goatpay.com.br/oauth/token
                revocation_endpoint: https://api.goatpay.com.br/oauth/revoke
                response_types_supported:
                  - code
                grant_types_supported:
                  - authorization_code
                  - refresh_token
                code_challenge_methods_supported:
                  - S256
                token_endpoint_auth_methods_supported:
                  - client_secret_post
                  - client_secret_basic
                scopes_supported:
                  - account:read
                  - account:write
                  - transactions:read
                  - transactions:write
                  - payments:read
                  - payments:write
                  - withdrawals:read
                  - withdrawals:create
                  - webhooks:read
                  - webhooks:write
  schemas:
    OAuthAuthorizationServerMetadata:
      type: object
      properties:
        issuer:
          type: string
          format: uri
        authorization_endpoint:
          type: string
          format: uri
        token_endpoint:
          type: string
          format: uri
        revocation_endpoint:
          type: string
          format: uri
        response_types_supported:
          type: array
          items:
            type: string
        grant_types_supported:
          type: array
          items:
            type: string
        code_challenge_methods_supported:
          type: array
          items:
            type: string
        token_endpoint_auth_methods_supported:
          type: array
          items:
            type: string
        scopes_supported:
          type: array
          items:
            type: string
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: Chave `gp_live_...` criada em Integrações → Chaves de API no dashboard.

````