OAuth Protected Resource metadata exists

low

agent_protocol_oauth_protected

Checks if OAuth Protected Resource Metadata is published for agents to discover authentication requirements.

What does this rule check?

OAuth Protected Resource Metadata at /.well-known/oauth-protected-resource tells AI agents which authorization servers can issue tokens for your APIs and what scopes are required. This is defined in RFC 9728.

Why is this important?

Without this metadata, agents cannot discover which authorization server to use or what scopes to request when accessing your protected resources. They must rely on trial-and-error or manual docs.

How to fix

Publish /.well-known/oauth-protected-resource with your resource identifier, authorization_servers list, and scopes_supported.

Examples

Incorrect 
GET /.well-known/oauth-protected-resource

HTTP/1.1 404 Not Found
Correct 
GET /.well-known/oauth-protected-resource

HTTP/1.1 200 OK

{"resource": "https://api.example.com", "authorization_servers": ["https://auth.example.com"], "scopes_supported": ["read", "write"]}

Agent fix snippet

Copy this snippet and paste it into your AI coding agent to fix this issue automatically.

Publish /.well-known/oauth-protected-resource:

{
  "resource": "https://api.yourdomain.com",
  "authorization_servers": ["https://auth.yourdomain.com"],
  "scopes_supported": ["read", "write"]
}