---
title: "Get OAuth protected resource metadata"
method: GET
path: "/.well-known/oauth-protected-resource"
tags: ["Public"]
---

# Get OAuth protected resource metadata

`GET /.well-known/oauth-protected-resource`

## Request

- Base URL: `https://api.proof.holdings`
- URL: `https://api.proof.holdings/.well-known/oauth-protected-resource`
- Auth: none declared

RFC 9728 protected resource metadata for the remote MCP server. Answers on two addresses: the root one our `WWW-Authenticate` header points at, and the path-suffixed canonical form a client derives from the resource identifier itself.

The suffix follows the deployment's `MCP_OAUTH_RESOURCE`, so the `/mcp` spelled here is the DEFAULT resource's. A deployment that moves the resource moves this address with it; read the live document rather than this path if you configure one.

## Response `200`

Protected resource metadata

- OAuthProtectedResourceMetadata
  - `resource` string, uri, required: The resource identifier a client must name in `resource` (RFC 8707) — the remote MCP server's own URL.
  - `authorization_servers` string[], required
  - `scopes_supported` string[], required
  - `bearer_methods_supported` string[], required
  - `resource_name` string, required
  - `resource_documentation` string, uri, required

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/6b8d61ee354f?raw)