---
title: "Protected resource metadata (RFC 9728)"
method: GET
path: "/.well-known/oauth-protected-resource"
tags: ["OAuth"]
---

# Protected resource metadata (RFC 9728)

`GET /.well-known/oauth-protected-resource`

## Request

- Base URL: `https://api.infolang.ai`
- URL: `https://api.infolang.ai/.well-known/oauth-protected-resource`
- Auth: none declared

Names the authorization server that governs this API. This is the document the `WWW-Authenticate` header on an unauthenticated `/mcp` request points at, and it is how a client discovers the OAuth flow at all. Public — no credential. That is not an oversight: a client cannot authenticate before it has a token, which is the entire purpose of this surface.

## Response `200`

Resource metadata

- object
  - `resource` string, required
  - `authorization_servers` string[], required
  - `scopes_supported` string[], required
  - `bearer_methods_supported` string[], required
  - `resource_documentation` string

---

[API](https://skmtc.dev/infolang/apis/infolang-api.md) · [All operations](https://skmtc.dev/infolang/apis/infolang-api/llms.txt) · [OpenAPI document](https://skmtc.dev/infolang/apis/infolang-api/revisions/d04bf6de72c8?raw)