---
title: "Mcp Oauth Protected Resource Metadata"
method: GET
path: "/.well-known/oauth-protected-resource/mcp"
---

# Mcp Oauth Protected Resource Metadata

`GET /.well-known/oauth-protected-resource/mcp`

## Request

- Base URL: `https://api.qualityclouds.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.qualityclouds.ai/.well-known/oauth-protected-resource/mcp`
- Auth: one of:
  - HTTP bearer
  - OpenID Connect (`https://account.qualityclouds.com//realms/ai-production/.well-known/openid-configuration`)

Serve the RFC 9728 protected-resource-metadata at the domain-root
well-known URI the /mcp 401 challenge advertises.

RFC 8615 well-known URIs must live at the domain root, but mounting
mcp_app under /mcp (above) nests FastMCP's own metadata route one level
down. The earlier QSA-1268 stopgap 307-redirected here, which breaks
strict OAuth clients (e.g. Claude Code) that do not follow redirects
during discovery — they never reach the nested document and report a
connection failure. Serving the document directly (200) at the advertised
URI is what RFC 9728 requires; the nested FastMCP route stays as-is.

The origin-level path (no ``/mcp`` suffix) is also published: MCP Inspector
probes it first and aborts OAuth when that probe returns 401 from the
generic API auth middleware.

## Response `200`

Successful Response

- unknown

## Other responses

- `401`: Unauthorized
- `403`: Forbidden

---

[API](https://skmtc.dev/qualityclouds/apis/qai-orchestrator-api.md) · [All operations](https://skmtc.dev/qualityclouds/apis/qai-orchestrator-api/llms.txt) · [OpenAPI document](https://skmtc.dev/qualityclouds/apis/qai-orchestrator-api/revisions/250c849925af?raw)