diff --git a/lib/towerops_web/controllers/well_known_controller.ex b/lib/towerops_web/controllers/well_known_controller.ex
index d3a946c4..93e4c3e0 100644
--- a/lib/towerops_web/controllers/well_known_controller.ex
+++ b/lib/towerops_web/controllers/well_known_controller.ex
@@ -4,74 +4,41 @@ defmodule ToweropsWeb.WellKnownController do
   use ToweropsWeb, :controller
 
   def api_catalog(conn, _params) do
-    base_url = ToweropsWeb.Endpoint.url()
-
     conn
     |> put_resp_content_type("application/linkset+json")
     |> json(%{
       "linkset" => [
         %{
-          "anchor" => "#{base_url}/api/v1",
-          "service-doc" => [%{"href" => "#{base_url}/docs/api"}],
-          "service-desc" => [%{"href" => "#{base_url}/docs/api", "type" => "text/html"}],
-          "status" => [%{"href" => "#{base_url}/health"}]
+          "anchor" => "#{base_url()}/api/v1",
+          "service-doc" => [%{"href" => "#{base_url()}/docs/api"}],
+          "service-desc" => [%{"href" => "#{base_url()}/docs/api", "type" => "text/html"}],
+          "status" => [%{"href" => "#{base_url()}/health"}]
         }
       ]
     })
   end
 
   def openid_configuration(conn, _params) do
-    base_url = ToweropsWeb.Endpoint.url()
-
-    json(conn, %{
-      "issuer" => base_url,
-      "authorization_endpoint" => "#{base_url}/oauth/authorize",
-      "token_endpoint" => "#{base_url}/oauth/token",
-      "jwks_uri" => "#{base_url}/.well-known/jwks.json",
-      "grant_types_supported" => ["authorization_code"],
-      "response_types_supported" => ["code"]
-    })
+    json(conn, oauth_server_metadata())
   end
 
   def oauth_authorization_server(conn, _params) do
-    base_url = ToweropsWeb.Endpoint.url()
-
-    json(conn, %{
-      "issuer" => base_url,
-      "authorization_endpoint" => "#{base_url}/oauth/authorize",
-      "token_endpoint" => "#{base_url}/oauth/token",
-      "jwks_uri" => "#{base_url}/.well-known/jwks.json",
-      "grant_types_supported" => ["authorization_code"],
-      "response_types_supported" => ["code"]
-    })
+    json(conn, oauth_server_metadata())
   end
 
   def oauth_protected_resource(conn, _params) do
-    base_url = ToweropsWeb.Endpoint.url()
-
     json(conn, %{
-      "resource" => "#{base_url}/api/v1",
-      "authorization_servers" => [base_url],
+      "resource" => "#{base_url()}/api/v1",
+      "authorization_servers" => [base_url()],
       "scopes_supported" => ["read", "write"]
     })
   end
 
   def mcp_server_card(conn, _params) do
-    base_url = ToweropsWeb.Endpoint.url()
-
     json(conn, %{
-      "serverInfo" => %{
-        "name" => "TowerOps",
-        "version" => "1.0.0"
-      },
-      "transport" => %{
-        "endpoint" => "#{base_url}/mcp"
-      },
-      "capabilities" => %{
-        "tools" => %{},
-        "resources" => %{},
-        "prompts" => %{}
-      }
+      "serverInfo" => %{"name" => "TowerOps", "version" => "1.0.0"},
+      "transport" => %{"endpoint" => "#{base_url()}/mcp"},
+      "capabilities" => %{"tools" => %{}, "resources" => %{}, "prompts" => %{}}
     })
   end
 
@@ -81,4 +48,17 @@ defmodule ToweropsWeb.WellKnownController do
       "skills" => []
     })
   end
+
+  defp base_url, do: ToweropsWeb.Endpoint.url()
+
+  defp oauth_server_metadata do
+    %{
+      "issuer" => base_url(),
+      "authorization_endpoint" => "#{base_url()}/oauth/authorize",
+      "token_endpoint" => "#{base_url()}/oauth/token",
+      "jwks_uri" => "#{base_url()}/.well-known/jwks.json",
+      "grant_types_supported" => ["authorization_code"],
+      "response_types_supported" => ["code"]
+    }
+  end
 end