---
title: "OAuth 2.0 protected resource metadata"
method: GET
path: "/.well-known/oauth-protected-resource"
tags: ["OAuth"]
---

# OAuth 2.0 protected resource metadata

`GET /.well-known/oauth-protected-resource`

## Request

- Base URL: `https://api.assinafy.com.br`
- URL: `https://api.assinafy.com.br/.well-known/oauth-protected-resource`
- Auth: none required

RFC 9728. Identifies this API as a protected resource, the
     *         authorization server(s) that can issue tokens for it, and the scopes it
     *         accepts. `scopes_supported` deliberately excludes `offline_access` — per the
     *         MCP specification, requesting a refresh token is a client concern, not
     *         something a resource is protected by. Also referenced from the
     *         `WWW-Authenticate: Bearer resource_metadata="..."` challenge on a 401/403.
     *         Per RFC 8615, the response is the bare metadata object itself — never this
     *         API's usual `{status, data, message}` envelope. The `authorization_servers` entry names the host that owns the browser-facing flow — start every integration by fetching `{authorization_servers[0]}/.well-known/oauth-authorization-server` (RFC 8414) from there, not from this API.

[Copy as Markdown](https://api.assinafy.com.br/v1/docs/markdown?method=get&path=%2F.well-known%2Foauth-protected-resource) [Open in ChatGPT](https://chatgpt.com/?q=Read%20the%20API%20documentation%20at%20https%3A%2F%2Fapi.assinafy.com.br%2Fv1%2Fdocs%2Fmarkdown%3Fmethod%3Dget%26path%3D%252F.well-known%252Foauth-protected-resource%20and%20help%20me%20integrate%20this%20endpoint.) [Open in Claude](https://claude.ai/new?q=Read%20the%20API%20documentation%20at%20https%3A%2F%2Fapi.assinafy.com.br%2Fv1%2Fdocs%2Fmarkdown%3Fmethod%3Dget%26path%3D%252F.well-known%252Foauth-protected-resource%20and%20help%20me%20integrate%20this%20endpoint.)

## Response `200`

The protected resource metadata

- object
  - `resource` string, uri
  - `authorization_servers` string[]
  - `scopes_supported` string[]
  - `bearer_methods_supported` string[]

## Other responses

- `500`: Unexpected server error.

## Changes

- **2026-09-17** `6b55ce24462c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/assinafy/apis/assinafy-api-reference/changes/.well-known/oauth-protected-resource/get.md)

---

[API](https://skmtc.dev/assinafy/apis/assinafy-api-reference.md) - [All operations](https://skmtc.dev/assinafy/apis/assinafy-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/assinafy/apis/assinafy-api-reference/revisions/f7da81a5567e?raw)