---
title: "Protected resource metadata defined | Agent Ready Checklist"
description: "Protected resource metadata: RFC 9728 JSON at /.well-known/oauth-protected-resource naming which authorization servers protect a resource."
canonical: https://agentreadychecklist.com/glossary/protected-resource-metadata
site: "Agent Ready Checklist"
last_updated: 2026-11-05
section: "Glossary"
---

# Protected resource metadata defined | Agent Ready Checklist

> Protected resource metadata: RFC 9728 JSON at /.well-known/oauth-protected-resource naming which authorization servers protect a resource.

Source: https://agentreadychecklist.com/glossary/protected-resource-metadata
Site: Agent Ready Checklist
Last reviewed: 2026-11-05
Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search)
Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free).

# Protected resource metadata

RFC 9728 JSON at /.well-known/oauth-protected-resource naming which authorization servers protect a resource. MCP servers must publish it. Example: {"resource":"https://api.example.com","authorization\_servers":\["https://auth.example.com"\]}. The spec cites RFC 8414 (authorization server metadata) and RFC 9728 (protected resource metadata) as best practice. MCP authorization requires servers to implement OAuth 2.0 Protected Resource Metadata and clients to use it to find the authorization server.

## Definition

RFC 9728 JSON at /.well-known/oauth-protected-resource naming which authorization servers protect a resource. MCP servers must publish it.

## Example

```json
{"resource":"https://api.example.com","authorization_servers":["https://auth.example.com"]}
```

## Nearby terms

-   [.well-known](https://agentreadychecklist.com/glossary/well-known/)URI prefix defined in RFC 8615 for site-wide metadata at fixed paths.
-   [MCP server](https://agentreadychecklist.com/glossary/mcp-server/)A server speaking the Model Context Protocol that exposes tools, resources and prompts to agent hosts.

## Asked about it

### What OAuth files should an agent be able to find?

Authorization server metadata at /.well-known/oauth-authorization-server (RFC 8414) or OIDC discovery, and protected resource metadata at /.well-known/oauth-protected-resource (RFC 9728). Cloudflare checks both separately.

## Sources

-   [isitagentready.com/.well-known/agent-skills/oauth-protected-resource/SKILL.md](https://isitagentready.com/.well-known/agent-skills/oauth-protected-resource/SKILL.md)read 2026-11-04
-   [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md)read 2026-11-04
-   [modelcontextprotocol.io/specification/2025-06-18/basic/authorization](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization)read 2026-11-04
-   [isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md](https://isitagentready.com/.well-known/agent-skills/oauth-discovery/SKILL.md)read 2026-11-04

Last reviewed 2026-11-05. AgentReady v2.0, read 2026-11-04.