Surety OAuth authority — see /.well-known/oauth-authorization-server