# protected-resource-metadata

Source: https://startwithidentity.com/glossary/protected-resource-metadata/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

OAuth 2.0 Protected Resource Metadata ([RFC 9728](https://www.rfc-editor.org/rfc/rfc9728), Proposed Standard, April 2025) is a JSON document an API publishes at `/.well-known/oauth-protected-resource` to tell clients which authorization servers issue tokens for it, which scopes it understands, and how tokens must be presented.

Before RFC 9728, a client had to be configured in advance with the authorization server for each API, which works for a fixed integration and fails for an agent that discovers tools at runtime. The RFC also adds a `resource_metadata` parameter to the `WWW-Authenticate` header, so a 401 response can point the client straight at the metadata. The Model Context Protocol made it mandatory for protected MCP servers, which turned a little-used RFC into one of the most implemented OAuth extensions of 2025 and 2026. Clients should still validate the metadata: the document's `resource` value has to match the URL they fetched it for, or an attacker can steer them to a hostile authorization server.

See also: [authorization server metadata](https://startwithidentity.com/glossary/authorization-server-metadata/), [MCP authorization](https://startwithidentity.com/glossary/mcp-authorization/), [resource indicators](https://startwithidentity.com/glossary/resource-indicators/), [authorization server](https://startwithidentity.com/glossary/authorization-server/), [OAuth 2.0](https://startwithidentity.com/standards/oauth-2-0/), [agent identity standards map 2026](https://startwithidentity.com/reports/agent-identity-standards-map-2026/)