# Protected resource metadata (RFC 9728)

> Source: https://elaichi.ai/docs/api-reference/oauth-discovery/well-known/getoauthprotectedresourcemetadata/

`GET /.well-known/oauth-protected-resource`

Resource: **.well Known** · API: **OAuth discovery**

## Response body

- **`resource`** _(string)_
  Canonical resource identifier of the MCP endpoint — the RFC 8707 audience.
- **`authorization_servers`** _(array<string>)_
  Issuers permitted to authorize access to this resource.
- **`scopes_supported`** _(array<string>)_
- **`bearer_methods_supported`** _(array<string>)_
  Always `["header"]` — the token goes in `Authorization`, never in a query string.
- **`resource_documentation`** _(string)_

## Code examples

### curl

```bash
curl -X GET 'https://api.elaichi.ai/.well-known/oauth-protected-resource' \
  -H 'Content-Type: application/json'
```

### JavaScript

```javascript
const response = await fetch('https://api.elaichi.ai/.well-known/oauth-protected-resource', {
  method: 'GET',
  headers: {
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data);
```

### Python

```python
import os
import requests

url = "https://api.elaichi.ai/.well-known/oauth-protected-resource"
headers = {
    "Content-Type": "application/json",
}

response = requests.get(url, headers=headers)
print(response.json())
```