diff --git a/internal/server/handlers.go b/internal/server/handlers.go
index 5dab375da..a77923593 100644
--- a/internal/server/handlers.go
+++ b/internal/server/handlers.go
@@ -83,3 +83,22 @@ func handleClose(unifiedServer *UnifiedServer) http.Handler {
 		}
 	})
 }
+
+// registerCommonEndpoints registers shared HTTP endpoints that are common to both routed and unified modes
+// This includes OAuth discovery, health check, and close endpoints
+func registerCommonEndpoints(mux *http.ServeMux, unifiedServer *UnifiedServer, apiKey string) {
+	// OAuth discovery endpoints - return 404 since we don't use OAuth
+	// Standard path for OAuth discovery (per RFC 8414)
+	mux.Handle("/.well-known/oauth-authorization-server", withResponseLogging(handleOAuthDiscovery()))
+	// MCP-prefixed path for backward compatibility
+	mux.Handle("/mcp/.well-known/oauth-authorization-server", withResponseLogging(handleOAuthDiscovery()))
+
+	// Health check (spec 8.1.1)
+	healthHandler := HandleHealth(unifiedServer)
+	mux.Handle("/health", withResponseLogging(healthHandler))
+
+	// Close endpoint for graceful shutdown (spec 5.1.3)
+	closeHandler := handleClose(unifiedServer)
+	finalCloseHandler := applyAuthIfConfigured(apiKey, closeHandler.ServeHTTP)
+	mux.Handle("/close", withResponseLogging(finalCloseHandler))
+}
diff --git a/internal/server/routed.go b/internal/server/routed.go
index 0ed2d069b..7910949fb 100644
--- a/internal/server/routed.go
+++ b/internal/server/routed.go
@@ -82,11 +82,8 @@ func CreateHTTPServerForRoutedMode(addr string, unifiedServer *UnifiedServer, ap
 	logRouted.Printf("Creating HTTP server for routed mode: addr=%s", addr)
 	mux := http.NewServeMux()
 
-	// OAuth discovery endpoints - return 404 since we don't use OAuth
-	// Standard path for OAuth discovery (per RFC 8414)
-	mux.Handle("/.well-known/oauth-authorization-server", withResponseLogging(handleOAuthDiscovery()))
-	// MCP-prefixed path for backward compatibility
-	mux.Handle("/mcp/.well-known/oauth-authorization-server", withResponseLogging(handleOAuthDiscovery()))
+	// Register common endpoints (OAuth discovery, health, close)
+	registerCommonEndpoints(mux, unifiedServer, apiKey)
 
 	// Create routes for all backends, plus sys only if DIFC is enabled
 	allBackends := unifiedServer.GetServerIDs()
@@ -147,10 +144,7 @@ func CreateHTTPServerForRoutedMode(addr string, unifiedServer *UnifiedServer, ap
 		shutdownHandler := rejectIfShutdown(unifiedServer, loggedHandler, "server:routed")
 
 		// Apply auth middleware if API key is configured (spec 7.1)
-		finalHandler := shutdownHandler
-		if apiKey != "" {
-			finalHandler = authMiddleware(apiKey, shutdownHandler.ServeHTTP)
-		}
+		finalHandler := applyAuthIfConfigured(apiKey, shutdownHandler.ServeHTTP)
 
 		// Mount the handler at both /mcp/<server> and /mcp/<server>/
 		mux.Handle(route+"/", finalHandler)
@@ -158,20 +152,6 @@ func CreateHTTPServerForRoutedMode(addr string, unifiedServer *UnifiedServer, ap
 		log.Printf("Registered route: %s", route)
 	}
 
-	// Health check (spec 8.1.1)
-	healthHandler := HandleHealth(unifiedServer)
-	mux.Handle("/health", withResponseLogging(healthHandler))
-
-	// Close endpoint for graceful shutdown (spec 5.1.3)
-	closeHandler := handleClose(unifiedServer)
-
-	// Apply auth middleware if API key is configured (spec 7.1)
-	finalCloseHandler := closeHandler
-	if apiKey != "" {
-		finalCloseHandler = authMiddleware(apiKey, closeHandler.ServeHTTP)
-	}
-	mux.Handle("/close", withResponseLogging(finalCloseHandler))
-
 	return &http.Server{
 		Addr:    addr,
 		Handler: mux,
diff --git a/internal/server/transport.go b/internal/server/transport.go
index 744a613cb..1ce4371e9 100644
--- a/internal/server/transport.go
+++ b/internal/server/transport.go
@@ -71,11 +71,8 @@ func CreateHTTPServerForMCP(addr string, unifiedServer *UnifiedServer, apiKey st
 	logTransport.Printf("Creating HTTP server for MCP: addr=%s, auth_enabled=%v", addr, apiKey != "")
 	mux := http.NewServeMux()
 
-	// OAuth discovery endpoints - return 404 since we don't use OAuth
-	// Standard path for OAuth discovery (per RFC 8414)
-	mux.Handle("/.well-known/oauth-authorization-server", withResponseLogging(handleOAuthDiscovery()))
-	// MCP-prefixed path for backward compatibility
-	mux.Handle("/mcp/.well-known/oauth-authorization-server", withResponseLogging(handleOAuthDiscovery()))
+	// Register common endpoints (OAuth discovery, health, close)
+	registerCommonEndpoints(mux, unifiedServer, apiKey)
 
 	logTransport.Print("Registering streamable HTTP handler for MCP protocol")
 	// Create StreamableHTTP handler for MCP protocol (supports POST requests)
@@ -131,17 +128,6 @@ func CreateHTTPServerForMCP(addr string, unifiedServer *UnifiedServer, apiKey st
 	mux.Handle("/mcp/", finalHandler)
 	mux.Handle("/mcp", finalHandler)
 
-	// Health check (spec 8.1.1)
-	healthHandler := HandleHealth(unifiedServer)
-	mux.Handle("/health", withResponseLogging(healthHandler))
-
-	// Close endpoint for graceful shutdown (spec 5.1.3)
-	closeHandler := handleClose(unifiedServer)
-
-	// Apply auth middleware if API key is configured (spec 7.1)
-	finalCloseHandler := applyAuthIfConfigured(apiKey, closeHandler.ServeHTTP)
-	mux.Handle("/close", withResponseLogging(finalCloseHandler))
-
 	return &http.Server{
 		Addr:    addr,
 		Handler: mux,