From 87625860d95cd151ea6c84681381b100e7befbf4 Mon Sep 17 00:00:00 2001
From: Maximilian Kaske <56969857+mxkaske@users.noreply.github.com>
Date: Thu, 17 Sep 2026 15:32:55 +0200
Subject: [PATCH] chore: openapi apps challenge token (#2735)

---
 apps/server/src/routes/oauth/index.ts      | 8 ++++++++
 apps/server/src/routes/oauth/oauth.test.ts | 9 +++++++++
 2 files changed, 17 insertions(+)

diff --git a/apps/server/src/routes/oauth/index.ts b/apps/server/src/routes/oauth/index.ts
index bbbe7fac..2cdab6bd 100644
--- a/apps/server/src/routes/oauth/index.ts
+++ b/apps/server/src/routes/oauth/index.ts
@@ -22,6 +22,9 @@ const logger = getLogger("api-server");
 
 const NO_STORE = { "Cache-Control": "no-store", Pragma: "no-cache" };
 
+const OPENAI_APPS_CHALLENGE_TOKEN =
+  "BY-vA_tzfuXZeVpuYKsUlluq9td0nTuyt-bTJXblZlw";
+
 type Body = Record<string, string | undefined>;
 
 /** Token and revoke accept form-encoded (RFC 6749) and JSON bodies. */
@@ -153,6 +156,11 @@ export function createOAuthRoutes(config: OAuthConfig) {
     c.json(protectedResourceMetadata(config.issuer)),
   );
 
+  // ChatGPT app submission domain proof; the token is public, not a secret.
+  app.get("/.well-known/openai-apps-challenge", (c) =>
+    c.text(OPENAI_APPS_CHALLENGE_TOKEN),
+  );
+
   // RFC 7591
   app.post("/oauth/register", async (c) => {
     const json: unknown = await c.req.json().catch(() => null);
diff --git a/apps/server/src/routes/oauth/oauth.test.ts b/apps/server/src/routes/oauth/oauth.test.ts
index 31766b8c..c86b5ef8 100644
--- a/apps/server/src/routes/oauth/oauth.test.ts
+++ b/apps/server/src/routes/oauth/oauth.test.ts
@@ -205,6 +205,15 @@ describe("well-known metadata", () => {
     });
   });
 
+  test("openai apps domain challenge", async () => {
+    const res = await app.request("/.well-known/openai-apps-challenge");
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toContain("text/plain");
+    expect(await res.text()).toBe(
+      "BY-vA_tzfuXZeVpuYKsUlluq9td0nTuyt-bTJXblZlw",
+    );
+  });
+
   test("answers CORS preflight", async () => {
     const res = await app.request("/oauth/token", {
       method: "OPTIONS",
-- 
2.51.2