MCP OAuth protected resource metadata

GET /.well-known/oauth-protected-resource/mcp

Returns OAuth 2.0 Protected Resource Metadata for the MCP endpoint as defined by RFC 9728. This endpoint is publicly accessible and does not require authentication. Responses are cached for one hour.

Required scope

Not required

Returns

200

MCP protected resource metadata retrieved successfully

Fields

resourcestring: The protected resource identifier
authorization_serversarray<string>: Authorization servers that can issue tokens for this resource
scopes_supportedarray<string>: Scopes supported by this resource
bearer_methods_supportedarray<string>: Methods supported for presenting bearer tokens