---
title: "OAuth protected-resource metadata for the ChatGPT MCP surface"
method: GET
path: "/.well-known/oauth-protected-resource/mcp/chatgpt"
---

# OAuth protected-resource metadata for the ChatGPT MCP surface

`GET /.well-known/oauth-protected-resource/mcp/chatgpt`

## Request

- Base URL: `https://charm.ing`
- URL: `https://charm.ing/.well-known/oauth-protected-resource/mcp/chatgpt`
- Auth: none declared

Returns the RFC 9728 path-scoped protected-resource metadata for the `/mcp/chatgpt` MCP surface, which is what its `WWW-Authenticate` challenge names on a 401. `resource` names `/mcp/chatgpt` on this origin rather than the origin itself, so a client can check the document answers for the endpoint it called. `authorization_servers` names the surface too while `CHARMING__SERVER__CHATGPT_AUTH_PROXY_ADVERTISED` is on, which is what sends this surface's clients to their own authorization-server document; otherwise it matches the origin-wide document.

## Response `200`

OAuth protected-resource discovery JSON scoped to /mcp/chatgpt.

- object: RFC 9728 protected-resource metadata (resource, authorization_servers, scopes_supported, …). Schema is delegated to better-auth; only `resource` is overridden.

---

[API](https://skmtc.dev/charm/apis/charming-api.md) · [All operations](https://skmtc.dev/charm/apis/charming-api/llms.txt) · [OpenAPI document](https://skmtc.dev/charm/apis/charming-api/revisions/a9d06c419b3a?raw)