# bitrefill probes, 2026-09-18T12:15Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 20000 (tools/list), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://api.bitrefill.com/mcp
$ curl -sS -i -m 25 -X POST https://api.bitrefill.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Fri, 18 Sep 2026 12:15:08 GMT
content-type: text/plain; charset=utf-8
content-length: 12
etag: W/"c-dAuDFQrdjS3hezqxDTNgW7AOlYk"
ratelimit-limit: 60
ratelimit-policy: 60;w=30
ratelimit-remaining: 59
ratelimit-reset: 30
server: cloudflare
vary: Accept-Encoding
www-authenticate: Bearer error="invalid_token", error_description="Invalid token"
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-robots-tag: noindex
cf-ray: a3d0463e18539005-BOS
alt-svc: h3=":443"; ma=86400

Unauthorized

## 2. Protected-resource metadata, GET https://api.bitrefill.com/.well-known/oauth-protected-resource/mcp (not named in the challenge; the path-aware well-known URI, the first fallback the specification names)
HTTP/1.1 200 Connection Established

HTTP/2 404 
date: Fri, 18 Sep 2026 12:15:09 GMT
content-type: text/html; charset=utf-8
content-length: 179
content-security-policy: default-src 'none'
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex
cf-ray: a3d04643c896a086-BOS
alt-svc: h3=":443"; ma=86400

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Error</title>
</head>
<body>
<pre>Cannot GET /.well-known/oauth-protected-resource/mcp</pre>
</body>
</html>


## 2b. Protected-resource metadata, GET https://api.bitrefill.com/.well-known/oauth-protected-resource (the root well-known URI, the second fallback; tried because step 2 answered 404, not 200)
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Fri, 18 Sep 2026 12:15:10 GMT
content-type: application/json; charset=utf-8
content-length: 249
etag: W/"f9-RENUUS1nsY4VW9w45SuCsafIJ+g"
server: cloudflare
vary: Accept-Encoding
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-robots-tag: noindex
cf-ray: a3d0464bfb108fff-BOS
alt-svc: h3=":443"; ma=86400

{"resource":"https://api.bitrefill.com/","authorization_servers":["https://api.bitrefill.com/oauth/mcp"],"scopes_supported":["mcp","cli"],"resource_name":"Bitrefill","resource_documentation":"https://www.bitrefill.com/account/developers/mcp-server"}

## 3. Authorization-server metadata, GET https://api.bitrefill.com/.well-known/oauth-authorization-server/oauth/mcp
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Fri, 18 Sep 2026 12:15:11 GMT
content-type: application/json; charset=utf-8
etag: W/"32a-8fmhYleYPIEyCq7y+45B7t/q1vc"
server: cloudflare
vary: Accept-Encoding
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-robots-tag: noindex
cf-ray: a3d04650ada84e45-BOS
alt-svc: h3=":443"; ma=86400

{"issuer":"https://api.bitrefill.com/oauth/mcp","service_documentation":"https://www.bitrefill.com/account/developers/mcp-server","authorization_endpoint":"https://api.bitrefill.com/oauth/mcp/authorize","response_types_supported":["code"],"code_challenge_methods_supported":["S256"],"token_endpoint":"https://api.bitrefill.com/oauth/mcp/token","token_endpoint_auth_methods_supported":["client_secret_post","none"],"grant_types_supported":["authorization_code","refresh_token","client_credentials"],"revocation_endpoint":"https://api.bitrefill.com/oauth/mcp/revoke","revocation_endpoint_auth_methods_supported":["client_secret_post","none"],"registration_endpoint":"https://api.bitrefill.com/oauth/mcp/register","client_id_metadata_document_supported":true,"authorization_response_iss_parameter_supported":true}

## 4. REST, GET https://api.bitrefill.com/v2/ping, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Fri, 18 Sep 2026 12:15:12 GMT
content-type: application/json; charset=utf-8
content-length: 63
etag: W/"3f-cJRcKMu2rW45BfwNgjgErmh+6wg"
server: cloudflare
vary: Accept-Encoding
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-robots-tag: noindex
cf-ray: a3d046552ae4b5c1-BOS
alt-svc: h3=":443"; ma=86400

{"message":"Authorization token not found","status":"no_token"}