RFC 9728 — OAuth 2.0 Protected Resource Metadata

Spec: datatracker.ietf.org/doc/html/rfc9728Status: Partial

RFC 9728 defines a well-known URL where a protected resource (resource server / API) publishes metadata — most importantly, which authorization servers it trusts. It completes the discovery chain used by the Model Context Protocol: a client hits the resource, reads its oauth-protected-resource metadata to find the authorization server, then reads that server's RFC 8414 metadata and registers via CIMD or DCR.

What is implemented

The Management API MCP server is a protected resource. When it is enabled, AuthHero serves:

• GET /.well-known/oauth-protected-resource/mcp (and the root /.well-known/oauth-protected-resource), with resource, authorization_servers, bearer_methods_supported, scopes_supported and resource_name.
• A WWW-Authenticate: Bearer resource_metadata="…" challenge on unauthenticated POST /mcp requests (§5.1).

Not implemented

• Metadata for other resource servers registered on a tenant. AuthHero is their authorization server, not their host.
• Signed metadata (signed_metadata).

Related AuthHero documentation

• Management API MCP Server
• RFC 8414 — Authorization Server Metadata
• Client ID Metadata Documents (CIMD)