Docs
OverviewGuidesZero & MCPAPI referenceChangelog
OAuth

Protected Resource Metadata

RFC 9728 metadata of the MCP endpoint (`/api/v1/mcp`): the authorization server and the scopes. 404 when `OAUTH_ENABLED=false`.

API key access

This route has its own authentication (or none); an API key is not used here.
GET/.well-known/oauth-protected-resource

Response Body

curl -X GET "http://localhost:8000/.well-known/oauth-protected-resource"
{
  "resource": "string",
  "authorization_servers": [
    "string"
  ],
  "scopes_supported": [
    "string"
  ],
  "bearer_methods_supported": [
    "string"
  ],
  "resource_name": "string"
}
Empty

Protected Resource Metadata (MCP)

The same document at the path-suffixed location (RFC 9728 §3.1) that a 401 from `/api/v1/mcp` names in `WWW-Authenticate: Bearer resource_metadata=...`.

Register Client

RFC 7591 dynamic client registration of a public client (no secret). Rate-limited per client IP (`OAUTH_REGISTER_RATE_LIMIT_PER_HOUR`); at most `OAUTH_MAX_CLIENTS` are kept (unused clients are evicted first, else 503).