OAuth 2.0 Protected Resource Metadata
OAuth 2.0 Protected Resource Metadata (RFC 9728, Proposed Standard, April 2025) is a JSON document an API publishes at /.well-known/oauth-protected-resource to tell clients which authorization servers issue tokens for it, which scopes it understands, and how tokens must be presented.
Before RFC 9728, a client had to be configured in advance with the authorization server for each API, which works for a fixed integration and fails for an agent that discovers tools at runtime. The RFC also adds a resource_metadata parameter to the WWW-Authenticate header, so a 401 response can point the client straight at the metadata. The Model Context Protocol made it mandatory for protected MCP servers, which turned a little-used RFC into one of the most implemented OAuth extensions of 2025 and 2026. Clients should still validate the metadata: the document's resource value has to match the URL they fetched it for, or an attacker can steer them to a hostile authorization server.
See also: authorization server metadata, MCP authorization, resource indicators, authorization server, OAuth 2.0, agent identity standards map 2026
Related on Start with Identity
- GlossaryOAuth Client ID Metadata Document (CIMD)
An OAuth Client ID Metadata Document (CIMD) is a JSON document of client metadata hosted at an HTTPS URL that the client uses as its `client_id`, so an authoriz
- GlossaryDynamic Client Registration (DCR)
OAuth 2.0 Dynamic Client Registration (DCR, [RFC 7591](https://www.rfc-editor.org/rfc/rfc7591), Proposed Standard, July 2015) defines a registration endpoint wh
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit