Public

Get OAuth protected resource metadata

RFC 9728 protected resource metadata for the remote MCP server. Answers on two addresses: the root one our WWW-Authenticate header points at, and the path-suffixed canonical form a client derives from the resource identifier itself.

The suffix follows the deployment's MCP_OAUTH_RESOURCE, so the /mcp spelled here is the DEFAULT resource's. A deployment that moves the resource moves this address with it; read the live document rather than this path if you configure one.

get/.well-known/oauth-protected-resource/mcp

Request

Base URL: https://api.proof.holdings
URL: https://api.proof.holdings/.well-known/oauth-protected-resource/mcp
Auth: none declared

Response

Protected resource metadata

resourcestring uri required

The resource identifier a client must name in resource (RFC 8707) — the remote MCP server's own URL.

authorization_serversstring[] required

scopes_supportedstring[] required

bearer_methods_supportedstring[] required

resource_namestring required

resource_documentationstring uri required

Example response

{
  "resource": "https://api.proof.holdings/mcp",
  "authorization_servers": [
    "https://api.proof.holdings"
  ],
  "scopes_supported": [
    "proofs:read",
    "verifications:read"
  ],
  "bearer_methods_supported": [
    "header"
  ],
  "resource_name": "Proof MCP server",
  "resource_documentation": "https://proof.holdings/docs"
}

Changes

No recorded changes to this operation across all 2 revisions of this API.