{
  "issuer": "https://www.alpha.ac",
  "jwks_uri": "https://www.alpha.ac/.well-known/jwks.json",
  "authorization_endpoint": "https://www.alpha.ac/auth",
  "response_types_supported": ["code"],
  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": ["RS256", "EdDSA"],
  "grant_types_supported": [],
  "scopes_supported": ["openid", "profile", "email"],
  "service_documentation": "https://www.alpha.ac/auth.md",
  "op_policy_uri": "https://www.alpha.ac/.well-known/jwks-rotation",
  "x-jwks-rotation-policy": "https://www.alpha.ac/.well-known/jwks-rotation",
  "x-planned": {
    "status": "planned, not implemented",
    "note": "These values describe a future partner token service. No route exists for the token endpoint today, so they are not advertised as supported OpenID Provider metadata.",
    "token_endpoint": "https://www.alpha.ac/api/public/oauth/token",
    "grant_types_supported": ["authorization_code", "client_credentials"],
    "token_endpoint_auth_methods_supported": ["client_secret_basic", "private_key_jwt"]
  },
  "x-status": "Alpha does not currently expose protected APIs requiring OIDC and does not issue ID tokens or access tokens from https://www.alpha.ac. No token endpoint is deployed, so grant_types_supported is empty and token-endpoint fields are listed under x-planned rather than advertised as supported. Partner integrations should contact hello@alpha.ac. The jwks_uri returns an empty key set until issuance keys are provisioned; rotation and expiration rules are published at /.well-known/jwks-rotation."
}