Index: src/services/ActivityPubService.js
===================================================================
--- src/services/ActivityPubService.js	(revision f1a23b8f4305f375087b6c69adc090e77dbd6de6)
+++ src/services/ActivityPubService.js	(revision d49b60b14f6ee15516f465adfeee2a51294134c7)
@@ -164,5 +164,13 @@
     following: `${id}/following`,
     featured: `${id}/featured`,
-    endpoints: { sharedInbox: `${base}/ap/inbox` },
+    // C2S clients (Shaer apps) discover auth + upload here — no hardcoded paths.
+    // All four are ActivityPub-spec `endpoints` terms. Dynamic client registration
+    // (RFC 7591) is discovered via /.well-known/oauth-authorization-server, not here.
+    endpoints: {
+      sharedInbox: `${base}/ap/inbox`,
+      oauthAuthorizationEndpoint: `${base}/oauth/authorize`,
+      oauthTokenEndpoint: `${base}/oauth/token`,
+      uploadMedia: `${id}/uploadMedia`,
+    },
     publicKey: {
       id: `${id}#main-key`,