---
title: "Protected resource metadata"
method: GET
path: "/.well-known/oauth-protected-resource"
tags: ["MCP"]
---

# Protected resource metadata

`GET /.well-known/oauth-protected-resource`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/.well-known/oauth-protected-resource`
- Auth: HTTP bearer

RFC 9728 metadata for the MCP endpoint. Served unauthenticated and free of secrets, because a
client fetches it before it holds any credential.

`authorization_servers` names this deployment's own OAuth 2.1 server (see
`/.well-known/oauth-authorization-server`), which is what makes a Connect button work for a
listing in Claude's connector directory or as a ChatGPT app. Existing key-authenticated
connectors keep working untouched alongside it.

## Response `200`

Where this resource lives and what scopes it understands.

- object
  - `resource` string, uri, required
  - `resource_name` string
  - `resource_documentation` string, uri
  - `bearer_methods_supported` string[]
  - `scopes_supported` ApiScope[], required

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)