diff --git a/pkg/auth/auth.go b/pkg/auth/auth.go
index e7440fffe..526d182b3 100644
--- a/pkg/auth/auth.go
+++ b/pkg/auth/auth.go
@@ -39,10 +39,11 @@ const (
 	OpEnumerate
 	OpRemove
 	OpSign
-	OpRead   = OpEnumerate | OpStat | OpGet
+	OpDiscovery
+	OpRead   = OpEnumerate | OpStat | OpGet | OpDiscovery
 	OpRW     = OpUpload | OpEnumerate | OpStat | OpGet // Not Remove
-	OpVivify = OpUpload | OpStat | OpGet
-	OpAll    = OpUpload | OpEnumerate | OpStat | OpRemove | OpGet | OpSign
+	OpVivify = OpUpload | OpStat | OpGet | OpDiscovery
+	OpAll    = OpUpload | OpEnumerate | OpStat | OpRemove | OpGet | OpSign | OpDiscovery
 )
 
 var kBasicAuthPattern = regexp.MustCompile(`^Basic ([a-zA-Z0-9\+/=]+)`)
diff --git a/pkg/server/root.go b/pkg/server/root.go
index f7076c774..4c9342189 100644
--- a/pkg/server/root.go
+++ b/pkg/server/root.go
@@ -120,8 +120,7 @@ func (rh *RootHandler) registerSyncHandler(h *SyncHandler) {
 
 func (rh *RootHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	if wantsDiscovery(req) {
-		// TODO(mpl): OpDiscovery
-		if auth.Allowed(req, auth.OpGet) {
+		if auth.Allowed(req, auth.OpDiscovery) {
 			rh.serveDiscovery(rw, req)
 			return
 		}