OAuth for MCP clients

Protected resource metadata

GET/.well-known/oauth-protected-resource

RFC 9728: tells an MCP client which authorisation server protects /mcp.

#Authentication

Public

No credential. Public routes are rate limited per address.

Request

curl "https://immiscible.fly.dev/.well-known/oauth-protected-resource"

const res = await fetch('https://immiscible.fly.dev/.well-known/oauth-protected-resource', {
});
const data = await res.json();
console.log(res.status, data);

import requests

res = requests.get(
    "https://immiscible.fly.dev/.well-known/oauth-protected-resource",
)
print(res.status_code, res.json())