---
title: "OAuth protected resource metadata"
method: GET
path: "/.well-known/oauth-protected-resource"
tags: ["OAuth"]
---

# OAuth protected resource metadata

`GET /.well-known/oauth-protected-resource`

## Request

- Base URL: `https://xn--s7y.xn--3ds443g`
- URL: `https://xn--s7y.xn--3ds443g/.well-known/oauth-protected-resource`
- Auth: none required

RFC 9728 document named by WWW-Authenticate `resource_metadata`. `resource` is `{origin}/mcp` with no trailing slash. `authorization_servers` is that origin. `bearer_methods_supported` is `header` only. `scopes_supported` is the issuable catalog (`links:disable` and `analytics:read` are omitted). Same JSON as the path-insert and `/mcp` aliases.

## Response `200`

Protected resource metadata

- OAuthProtectedResourceMetadata
  - `resource` string, required: {origin}/mcp with no trailing slash
  - `authorization_servers` string[], required
  - `scopes_supported` string[], required
  - `bearer_methods_supported` string[], required

---

[API](https://skmtc.dev/xn--s7y/apis/agent-api.md) · [All operations](https://skmtc.dev/xn--s7y/apis/agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xn--s7y/apis/agent-api/revisions/d902f68518e9?raw)