# OAUTH Protected Resource

> Publish OAuth Protected Resource Metadata

- Skill: `whiteknightonhorse/oauth-protected-resource` (Agent Skill)
- Install (CLI): `npx skillmds@latest add whiteknightonhorse/oauth-protected-resource`
- Raw SKILL.md: https://api.skillmd.com/api/skills/whiteknightonhorse/oauth-protected-resource/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: whiteknightonhorse (https://skillmd.com/u/whiteknightonhorse)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/whiteknightonhorse/oauth-protected-resource

---

# Publish OAuth Protected Resource Metadata

> AIPUSH agent skill · Category: Identity & Auth · Slug: `oauth-protected-resource`

RFC 9728 metadata tells agents which authorization servers can issue tokens for your resource and which scopes exist — so they can obtain the right access token.

## Why it matters

RFC 9728 metadata tells agents which authorization servers can issue tokens for your resource and which scopes exist — so they can obtain the right access token.

## How to detect

Request `https://YOURDOMAIN/.well-known/oauth-protected-resource` (HTTP 200, valid JSON).

## How to implement

Serve `/.well-known/oauth-protected-resource`:

```json
{
  "resource": "https://YOURDOMAIN",
  "authorization_servers": ["https://YOURDOMAIN"],
  "scopes_supported": ["read", "write"],
  "bearer_methods_supported": ["header"]
}
```

## How to verify

`curl -s https://YOURDOMAIN/.well-known/oauth-protected-resource | jq .authorization_servers` lists your AS.

## References

- https://www.rfc-editor.org/rfc/rfc9728

---

Part of the [AIPUSH agent skills catalog](https://aipush.app/.well-known/agent-skills/index.json). Scan your site free at https://aipush.app.