RFC 9728. Identifies this API as a protected resource, the * authorization server(s) that can issue tokens for it, and the scopes it * accepts. scopes_supported deliberately excludes offline_access — per the * MCP specification, requesting a refresh token is a client concern, not * something a resource is protected by. Also referenced from the * WWW-Authenticate: Bearer resource_metadata="..." challenge on a 401/403. * Per RFC 8615, the response is the bare metadata object itself — never this * API's usual {status, data, message} envelope. The authorization_servers entry names the host that owns the browser-facing flow — start every integration by fetching {authorization_servers[0]}/.well-known/oauth-authorization-server (RFC 8414) from there, not from this API.

Copy as Markdown Open in ChatGPT Open in Claude

{
  "bearer_methods_supported": [
    "header"
  ]
}