---
title: "Get protected resource metadata (RFC 9728)"
method: GET
path: "/.well-known/oauth-protected-resource"
tags: ["OAuth discovery"]
---

# Get protected resource metadata (RFC 9728)

`GET /.well-known/oauth-protected-resource`

## Request

- Base URL: `https://api.elaichi.ai`
- URL: `https://api.elaichi.ai/.well-known/oauth-protected-resource`
- Auth: none required

Describes the MCP endpoint and names the authorization server that protects it. Public, unauthenticated, and readable cross-origin from any origin by design (a wildcard, deliberately uncredentialed CORS policy) — an MCP client fetches it before it holds any credential, often from a browser context. Discovery starts here: an unauthenticated `POST /mcp` answers 401 with a `WWW-Authenticate` header whose `resource_metadata` parameter points at this document; follow `authorization_servers[0]` to `/.well-known/oauth-authorization-server` for the endpoint URLs. Cached for one hour.

## Response `200`

OK

- object
  - `resource` string, uri: Canonical resource identifier of the MCP endpoint — the RFC 8707 audience.
  - `authorization_servers` string[]: Issuers permitted to authorize access to this resource.
  - `scopes_supported` string[]
  - `bearer_methods_supported` string[]: Always `["header"]` — the token goes in `Authorization`, never in a query string.
  - `resource_documentation` string, uri

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/elaichi/apis/elaichi-api.md) · [All operations](https://skmtc.dev/elaichi/apis/elaichi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaichi/apis/elaichi-api/revisions/b22cfb7b6d15?raw)