OAuth discovery

Get protected resource metadata (RFC 9728)

Describes the MCP endpoint and names the authorization server that protects it. Public, unauthenticated, and readable cross-origin from any origin by design (a wildcard, deliberately uncredentialed CORS policy) — an MCP client fetches it before it holds any credential, often from a browser context. Discovery starts here: an unauthenticated POST /mcp answers 401 with a WWW-Authenticate header whose resource_metadata parameter points at this document; follow authorization_servers[0] to /.well-known/oauth-authorization-server for the endpoint URLs. Cached for one hour.

get/.well-known/oauth-protected-resource

Request

  • Base URL: https://api.elaichi.ai
  • URL: https://api.elaichi.ai/.well-known/oauth-protected-resource
  • Auth: none required

Response

OK

resourcestring uri

Canonical resource identifier of the MCP endpoint — the RFC 8707 audience.

authorization_serversstring[]

Issuers permitted to authorize access to this resource.

scopes_supportedstring[]
bearer_methods_supportedstring[]

Always ["header"] — the token goes in Authorization, never in a query string.

resource_documentationstring uri

Changes

No recorded changes to this operation across all 1 revision of this API.