Metadata

Protected-resource metadata (RFC 9728 + auth.md agent_auth)

Machine-readable description of how to obtain a credential for this API, served from the API host itself.

This is the document the WWW-Authenticate challenge on every 401 points at, so it MUST be keyless — a discovery document that requires the credential it explains how to get is a closed loop. It is served here rather than only on the docs site because resource_metadata resolves against the RESOURCE: an agent probing api.rateapi.dev for it and getting a 404 concludes this API publishes nothing.

It advertises exactly what rateAPI implements: opaque rk_ API keys obtained by an unauthenticated POST /keys. There is no OAuth authorization server, no token endpoint, and no assertion exchange, so authorization_servers is absent and identity_types_supported is ["anonymous"] alone.

get/.well-known/oauth-protected-resource

Request

  • Base URL: https://api.rateapi.dev
  • URL: https://api.rateapi.dev/.well-known/oauth-protected-resource
  • Auth: none required

Response

The metadata document. Edge-cached; safe to fetch once and reuse.

resourcestring uri required

Canonical identifier of the protected resource these credentials are for.

resource_namestring

Human-readable name of this protected resource.

resource_documentationstring uri

Machine-readable documentation for the resource — this API’s OpenAPI spec.

bearer_methods_supportedstring[]

Only header. The X-API-Key spelling is equivalent but has no registered vocabulary term, so it is described in agent_auth.notes instead.

bearer_token_prefixstring

Every credential starts with this. Keys are opaque and must not be parsed.

scopes_supportedstring[]

Empty: keys carry no scopes at all. Stated positively so a client does not read an absent field as an oversight.

Example response

{
  "resource": "https://api.rateapi.dev",
  "resource_name": "rateAPI",
  "resource_documentation": "https://api.rateapi.dev/openapi.json",
  "bearer_token_prefix": "rk_",
  "agent_auth": {
    "skill": "https://rateapi.dev/auth.md",
    "register_uri": "https://api.rateapi.dev/keys",
    "anonymous": {
      "register_uri": "https://api.rateapi.dev/keys",
      "register_method": "POST",
      "credential_type": "api_key",
      "credential_prefix": "rk_",
      "credential_delivery": "registration_response",
      "identical_retry_window_seconds": 86400,
      "documentation": "https://rateapi.dev/auth.md"
    },
    "revocation_method": "DELETE"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.