Skip to main content

Discover authentication

Start by calling the MCP/UCP endpoint normally. If the resource requires authorization, it should return a 401 challenge with a pointer to OAuth Protected Resource Metadata.

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource", scope="search:read ext_token:read"

1. Fetch protected-resource metadata​

GET https://mcp.example.com/.well-known/oauth-protected-resource

Example response:

{
  "resource": "https://mcp.example.com/mcp",
  "authorization_servers": [
    "https://api.aigw.loginid.ai/<RESOURCE_ID>"
  ],
  "scopes_supported": ["search:read", "ext_token:read"]
}

Use the advertised authorization-server base URL rather than hard-coding an AIGW Resource ID.

2. Fetch AIGW discovery​

GET https://api.aigw.loginid.ai/<RESOURCE_ID>/.well-known/openid-configuration

The discovery document exposes, among other values:

  • per-resource authorization endpoint;
  • global/core token endpoint;
  • registration endpoint;
  • supported scopes including the resource's own scopes;
  • PKCE support;
  • supported token-endpoint authentication methods.

The document's issuer and jwks_uri point to the core AIGW issuer/key set for agent-facing tokens, while the authorization endpoint itself is per-resource.

3. Select requested scopes​

Use discovery to determine supported scopes, then request the minimum needed by the MCP/UCP operation. Resource-specific scopes such as search:read are configured by the Resource owner.

Continue to Register with AIGW.

The Resource discovery URL is not the token issuer: validate tokens against the issuer exactly as discovery returns it. If a registration response also returns global endpoints, keep using the Resource authorization_endpoint from discovery. See OAuth metadata.