---
title: "OAuth protected-resource metadata (delegated to better-auth)"
method: GET
path: "/.well-known/oauth-protected-resource"
---

# OAuth protected-resource metadata (delegated to better-auth)

`GET /.well-known/oauth-protected-resource`

## Request

- Base URL: `https://charm.ing`
- URL: `https://charm.ing/.well-known/oauth-protected-resource`
- Auth: none declared

Returns the RFC 9728 protected-resource metadata for the Charming API origin. Read by clients that treat the origin as the protected resource; a client asking about one MCP surface reads the path-scoped document under this path instead, which is what that surface names in its 401 `WWW-Authenticate` header.

## Response `200`

OAuth protected-resource discovery JSON.

- object: RFC 9728 protected-resource metadata (resource, authorization_servers, scopes_supported, …). Schema is delegated to better-auth.

---

[API](https://skmtc.dev/charm/apis/charming-api.md) · [All operations](https://skmtc.dev/charm/apis/charming-api/llms.txt) · [OpenAPI document](https://skmtc.dev/charm/apis/charming-api/revisions/a9d06c419b3a?raw)