Protected resource metadata (RFC 9728)

GET /.well-known/oauth-protected-resource

Describes the MCP endpoint and names the authorization server that protects it. Public, unauthenticated, and readable cross-origin from any origin by design (a wildcard, deliberately uncredentialed CORS policy) — an MCP client fetches it before it holds any credential, often from a browser context. Discovery starts here: an unauthenticated `POST /mcp` answers 401 with a `WWW-Authenticate` header whose `resource_metadata` parameter points at this document; follow `authorization_servers[0]` to `/.well-known/oauth-authorization-server` for the endpoint URLs. Cached for one hour.

Response Body

authorization_serversstring[]

Issuers permitted to authorize access to this resource.

bearer_methods_supportedstring[]

Always ["header"] — the token goes in Authorization, never in a query string.

resourcestring · uri

Canonical resource identifier of the MCP endpoint — the RFC 8707 audience.

resource_documentationstring · uri

scopes_supportedstring[]

Possible values:

mcp:readmcp:writemcp:destructivemcp:toolsopenidemail

curl -X GET 'https://api.elaichi.ai/.well-known/oauth-protected-resource' \
  -H 'Content-Type: application/json'

const response = await fetch('https://api.elaichi.ai/.well-known/oauth-protected-resource', {
  method: 'GET',
  headers: {
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data);

import os
import requests

url = "https://api.elaichi.ai/.well-known/oauth-protected-resource"
headers = {
    "Content-Type": "application/json",
}

response = requests.get(url, headers=headers)
print(response.json())