OAuth 2.0 Protected Resource Metadata
OAuth 2.0 Protected Resource Metadata, defined in RFC 9728, is a JSON document a protected resource -- such as an MCP server acting as an OAuth resource server -- publishes at a well-known URL to tell a client which authorization server issues valid tokens for it, along with the scopes it supports and how it expects a bearer token to be presented. Rather than a client needing this configuration in advance, the resource server returns a WWW-Authenticate header pointing to its metadata document whenever it rejects an unauthenticated request, so an unfamiliar client can discover how to authenticate from a single 401 response instead of failing with no path forward. The MCP authorization specification requires an MCP server to publish this metadata specifically so a general-purpose MCP client can connect to a server it has never seen before and still complete the OAuth flow correctly, without the server's operator and the client's developer having coordinated configuration out of band.
By AdminKit team, Netbase JSC · Updated