Oauth Protected Resource For Path

RFC 9728 §3.1 path-inserted document: the resource is the URL the client is actually calling.

A client checks the resource it gets back against the URL it connected to, byte for byte. Ours answered /mcp/ to everyone, so a client that connected to /mcp — the form the landing page's install button hands out — failed the check AFTER the person had already signed in and a key had been issued: "Protected resource .../mcp/ does not match expected .../mcp". Every attempt left another revoked key behind (12 of them on one account before this was traced, 2026-09-21).

The path is read off the raw request rather than from a route parameter, because a parameter arrives already stripped of its trailing slash and the slash is the whole point: the two spellings are different resource identifiers to the client, and each has to be told its own.