# resource-indicators

Source: https://startwithidentity.com/glossary/resource-indicators/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

Resource Indicators for OAuth 2.0 ([RFC 8707](https://www.rfc-editor.org/rfc/rfc8707), Proposed Standard, February 2020) define a `resource` request parameter a client sends to the authorization server to name the API it intends to call, so the server can audience-restrict the access token to that API.

Without a resource indicator, one access token often works at every API that trusts the same authorization server, so a token leaked from, or deliberately replayed by, a low-value service opens high-value ones. RFC 8707 closes that by letting the token's audience say exactly which resource server may accept it, and the resource server must reject tokens minted for someone else. The Model Context Protocol requires MCP clients to send the `resource` parameter in both authorization and token requests for this reason: a malicious MCP server must not be able to replay a user's token at another server. Audience checks only help if resource servers actually enforce them, which is the step most often skipped.

See also: [access token](https://startwithidentity.com/glossary/access-token/), [scope](https://startwithidentity.com/glossary/scope/), [MCP authorization](https://startwithidentity.com/glossary/mcp-authorization/), [protected resource metadata](https://startwithidentity.com/glossary/protected-resource-metadata/), [bearer token](https://startwithidentity.com/glossary/bearer-token/), [token replay against unbound endpoints](https://startwithidentity.com/techniques/token-replay-unbound-endpoint/), [cross-tenant token confusion](https://startwithidentity.com/techniques/cross-tenant-token-confusion/)