---
title: "OAuth 2.0 Protected Resource Metadata for the MCP endpoint"
method: GET
path: "/.well-known/oauth-protected-resource/mcp"
tags: ["MCP"]
---

# OAuth 2.0 Protected Resource Metadata for the MCP endpoint

`GET /.well-known/oauth-protected-resource/mcp`

OAuth 2.0 Protected Resource Metadata ([RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728))
for `POST /mcp`, which MCP `2026-07-28` requires every protected MCP
server to publish so a client can discover the authorization server on
its own instead of being handed a pre-configured token.

Served without a token - it is the one route besides `/health` that
skips gateway auth, since a client fetches it precisely because it has
no credentials yet. Every `401` from `POST /mcp` points here through the
`resource_metadata` parameter of its `WWW-Authenticate` challenge.

Returns `404` unless `AUTH_ENABLED=true` and the MCP endpoint is exposed
(`MCP_ENABLED=true` and `MCP_EXPOSE=true`): with no authorization server
there is nothing to advertise.

`resource` is `MCP_RESOURCE_URL` when set, and otherwise the request
scheme (honouring `X-Forwarded-Proto`) and `Host` with `/mcp` appended.
Behind an ingress that rewrites either, set `MCP_RESOURCE_URL` to the
canonical public URL clients use.

Tokens must be issued for that resource (RFC 8707): when the IdP stamps
the resource indicator into `aud`, list the same value in
`AUTH_OIDC_AUDIENCE`.

## Response `200`

The Protected Resource Metadata document

- OAuthProtectedResourceMetadata — OAuth 2.0 Protected Resource Metadata (RFC 9728) for the gateway's MCP endpoint. Only the fields a client needs to find the authorization server are published.
  - `resource` string, required — The canonical public URL of the protected resource
  - `authorization_servers` string[], required — Issuer identifiers of the authorization servers that mint tokens for this resource
  - `bearer_methods_supported` string[], required — How a bearer token may be sent; the gateway reads the Authorization header only

## Other responses

- `404` — Not found

## Changes

- **2026-09-25** `0719fad9dbb1` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/inference-gateway/apis/inference-gateway-api/changes/.well-known/oauth-protected-resource/mcp/get.md)

---

[API](https://skmtc.dev/inference-gateway/apis/inference-gateway-api.md) · [All operations](https://skmtc.dev/inference-gateway/apis/inference-gateway-api/llms.txt) · [OpenAPI document](https://skmtc.dev/inference-gateway/apis/inference-gateway-api/revisions/1b23a23c6ece?raw)