diff --git a/.env.staging b/.env.staging
index 87c1792..dd9c7a9 100644
--- a/.env.staging
+++ b/.env.staging
@@ -38,7 +38,7 @@ VALKEY_PASSWORD="CHANGE_ME"
 
 TAP_ADMIN_PASSWORD="CHANGE_ME"
 RELAY_URL="wss://bsky.network"
-OAUTH_CLIENT_ID="https://staging.barazo.forum"
+OAUTH_CLIENT_ID="https://staging.barazo.forum/oauth-client-metadata.json"
 OAUTH_REDIRECT_URI="https://staging.barazo.forum/api/auth/callback"
 
 # ==============================================================================
diff --git a/Caddyfile b/Caddyfile
index 9538511..fa11a2d 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -24,6 +24,14 @@
 		}
 	}
 
+	# OAuth metadata (AT Protocol requires PDS to fetch these from the client_id origin)
+	handle /oauth-client-metadata.json {
+		reverse_proxy barazo-api:3000
+	}
+	handle /jwks.json {
+		reverse_proxy barazo-api:3000
+	}
+
 	# API routes -> barazo-api:3000
 	handle /api/* {
 		reverse_proxy barazo-api:3000