Discover which authorization servers protect this resource
GET
/.well-known/oauth-protected-resource
const url = 'https://api.adversarial.com/api/.well-known/oauth-protected-resource';const options = {method: 'GET'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://api.adversarial.com/api/.well-known/oauth-protected-resourceReturns the RFC 9728 protected resource metadata document: the canonical resource URI, the authorization servers whose tokens are accepted here, the supported scopes, and how a bearer token should be presented.
Responses
Section titled “Responses”Protected resource metadata
Media typeapplication/json
object
authorization_servers
required
Authorization servers that issue tokens accepted at this resource.
Array<string>
bearer_methods_supported
required
Array<string>
resource
required
Canonical URI of the resource (in our case, the MCP endpoint).
string
scopes_supported
required
Array<string>
Examplegenerated
{ "authorization_servers": [ "example" ], "bearer_methods_supported": [ "example" ], "resource": "example", "scopes_supported": [ "example" ]}