---
title: "OAuth protected-resource metadata for the inline MCP surface"
method: GET
path: "/.well-known/oauth-protected-resource/mcp/inline"
---

# OAuth protected-resource metadata for the inline MCP surface

`GET /.well-known/oauth-protected-resource/mcp/inline`

## Request

- Base URL: `https://charm.ing`
- URL: `https://charm.ing/.well-known/oauth-protected-resource/mcp/inline`
- Auth: none declared

Returns the RFC 9728 path-scoped protected-resource metadata for the `/mcp/inline` MCP surface, which is what its `WWW-Authenticate` challenge names on a 401. Identical to the origin-wide document except that `resource` names `/mcp/inline` on this origin rather than the origin itself, so a client can check the document answers for the endpoint it called.

## Response `200`

OAuth protected-resource discovery JSON scoped to /mcp/inline.

- object: RFC 9728 protected-resource metadata (resource, authorization_servers, scopes_supported, …). Schema is delegated to better-auth; only `resource` is overridden.

---

[API](https://skmtc.dev/charm/apis/charming-api.md) · [All operations](https://skmtc.dev/charm/apis/charming-api/llms.txt) · [OpenAPI document](https://skmtc.dev/charm/apis/charming-api/revisions/a9d06c419b3a?raw)