Oauth Protected Resource Pathed

RFC 9728 path-suffixed variant.

Some MCP clients (e.g. VS Code) derive the metadata URL from the resource path — /.well-known/oauth-protected-resource/<path> — instead of using the WWW-Authenticate resource_metadata value, and validate that the returned resource matches the exact URL they connected to (e.g. .../mcp/mcp). Serving this variant lets those clients complete discovery and delegate to the authorization server (Keycloak), where DCR is same-origin and works.

get/.well-known/oauth-protected-resource/{resource_path}

Request

  • Base URL: https://mcp.sentinelx.app (the document declares no server; this is the origin it was published from)
  • URL: https://mcp.sentinelx.app/.well-known/oauth-protected-resource/{resource_path}
  • Auth: none declared

Path parameters

resource_pathstring required

Response

Successful Response

object required

Changes

No recorded changes to this operation across all 1 revision of this API.