diff --git a/src/server.ts b/src/server.ts
index 75763be..658ac81 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -15,9 +15,13 @@ export const app = new Hono();
 app.use('/public/*', serveStatic({ root: './' }));
 
 // OAuth metadata endpoints at root level
+// These MUST be publicly accessible (no authentication)
 app.get('/client-metadata.json', async (c) => {
   try {
     const metadata = await getClientMetadata();
+    // Set appropriate cache headers
+    c.header('Cache-Control', 'public, max-age=600'); // Cache for 10 minutes
+    c.header('Access-Control-Allow-Origin', '*');
     return c.json(metadata);
   } catch (error) {
     console.error('Error getting client metadata:', error);
@@ -28,6 +32,9 @@ app.get('/client-metadata.json', async (c) => {
 app.get('/jwks.json', async (c) => {
   try {
     const jwks = await getJwks();
+    // Set appropriate cache headers
+    c.header('Cache-Control', 'public, max-age=600'); // Cache for 10 minutes
+    c.header('Access-Control-Allow-Origin', '*');
     return c.json(jwks);
   } catch (error) {
     console.error('Error getting JWKS:', error);