Skip to main content

Protected Resource Metadata

OAuth Protected Resource Metadata tells an agent which authorization server protects the MCP/UCP endpoint.

MCP server response​

An unauthenticated request should receive a challenge such as:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource", scope="search:read ext_token:read"

Metadata document​

{
  "resource": "https://mcp.example.com/mcp",
  "authorization_servers": [
    "https://api.aigw.loginid.ai/<RESOURCE_ID>"
  ],
  "scopes_supported": ["search:read", "ext_token:read"]
}

The AIGW Token exchange Resource Reference page includes Download oauth-protected-resource.json for this purpose.

The agent uses authorization_servers to find AIGW discovery. Keep the metadata public and free of secrets.

Set resource to the canonical MCP endpoint and register that exact URL as the AIGW Resource indicator. Use it in both authorization and token requests, in AIGW access-token audience validation, and in credential redemption. The merchant API URL is configured separately in your backend. An exported Resource jwks_uri verifies merchant assertions. Agents and MCP/UCP services use the core jwks_uri inside AIGW discovery to validate platform tokens.