---
title: "OAuth protected resource metadata"
method: GET
path: "/.well-known/oauth-protected-resource"
tags: ["auth", "discovery"]
---

# OAuth protected resource metadata

`GET /.well-known/oauth-protected-resource`

## Request

- Base URL: `https://www.stuntdouble.io`
- URL: `https://www.stuntdouble.io/.well-known/oauth-protected-resource`
- Auth: none declared

The RFC 9728 metadata for the protected resource, the MCP server on `https://app.stuntdouble.io`, served on this host as well. It names the resource, its authorization server, `scopes_supported` and `bearer_methods_supported`.

## Response `200`

The protected resource metadata.

- object
  - `resource` string, uri, required
  - `authorization_servers` string[], required
  - `scopes_supported` string[]
  - `bearer_methods_supported` string[]

---

[API](https://skmtc.dev/stuntdouble/apis/stunt-double-public-api.md) · [All operations](https://skmtc.dev/stuntdouble/apis/stunt-double-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/stuntdouble/apis/stunt-double-public-api/revisions/f7d32f1d1c42?raw)