diff --git a/server/core/src/https/oauth2.rs b/server/core/src/https/oauth2.rs
index 88eae89c6..32888dc51 100644
--- a/server/core/src/https/oauth2.rs
+++ b/server/core/src/https/oauth2.rs
@@ -603,7 +603,35 @@ pub async fn oauth2_openid_discovery_get(
         .qe_r_ref
         .handle_oauth2_openid_discovery(client_id, kopid.eventid)
         .await;
-    to_axum_response(res)
+
+    match res {
+        Ok(dsc) => {
+            // Humans may look at this so we pretty it.
+            #[allow(clippy::unwrap_used)]
+            let body = serde_json::to_string_pretty(&dsc).unwrap();
+            #[allow(clippy::unwrap_used)]
+            Response::builder()
+                .status(StatusCode::OK)
+                .header(ACCESS_CONTROL_ALLOW_ORIGIN, "*")
+                .body(Body::from(body))
+                .unwrap()
+        }
+        Err(e) => {
+            error!(err = ?e, "Unable to access discovery info");
+            let body = match serde_json::to_string(&e) {
+                Ok(val) => val,
+                Err(e) => {
+                    format!("{:?}", e)
+                }
+            };
+            #[allow(clippy::unwrap_used)]
+            Response::builder()
+                .status(StatusCode::BAD_REQUEST)
+                .header(ACCESS_CONTROL_ALLOW_ORIGIN, "*")
+                .body(Body::from(body))
+                .unwrap()
+        }
+    }
 }
 
 pub async fn oauth2_openid_userinfo_get(
diff --git a/server/web_ui/pkg/kanidmd_web_ui_bg.wasm b/server/web_ui/pkg/kanidmd_web_ui_bg.wasm
index 38a5486ed..175596e58 100644
Binary files a/server/web_ui/pkg/kanidmd_web_ui_bg.wasm and b/server/web_ui/pkg/kanidmd_web_ui_bg.wasm differ
diff --git a/server/web_ui/src/oauth2.rs b/server/web_ui/src/oauth2.rs
index 342c4bbf1..ef8e40fbc 100644
--- a/server/web_ui/src/oauth2.rs
+++ b/server/web_ui/src/oauth2.rs
@@ -151,6 +151,13 @@ impl Oauth2App {
             .set("content-type", "application/json")
             .expect_throw("failed to set header");
 
+        if let Some(bearer_token) = models::get_bearer_token() {
+            request
+                .headers()
+                .set("authorization", &bearer_token)
+                .expect_throw("failed to set authorisation header");
+        }
+
         let window = utils::window();
         let resp_value = JsFuture::from(window.fetch_with_request(&request)).await?;
         let resp: Response = resp_value.dyn_into().expect_throw("Invalid response type");