Protected resource metadata (MCP endpoint)

GET

/.well-known/oauth-protected-resource

RFC 9728 protected resource metadata for the MCP endpoint. Public,
unauthenticated. Identical body to the path-insertion form below:
some clients probe this bare path unconditionally regardless of the
resource's own path shape.

Request

Authorization

API Key

Add parameter in header

x-api-key

Example:

x-api-key: ********************

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Responses

🟢200OK

application/json

Protected resource metadata.

Headers

Bodyapplication/json

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://upload.tf/api/v1/.well-known/oauth-protected-resource' \
--header 'x-api-key: <api-key>'

Response Example

{
    "resource": "http://example.com",
    "authorization_servers": [
        "http://example.com"
    ],
    "bearer_methods_supported": [
        "header"
    ],
    "scopes_supported": [
        "sites:read",
        "sites:write"
    ]
}

Modified at 2026-08-07 15:42:15

Authorization server metadata

Protected resource metadata (RFC 9728 §3.1 path-insertion form)