--- title: "Add OAuth metadata | Agent Ready Checklist" description: "How to add OAuth metadata. Publish authorization server and protected resource metadata so an agent can start a delegated flow without reading your docs." canonical: https://agentreadychecklist.com/guides/add-oauth-metadata site: "Agent Ready Checklist" last_updated: 2026-11-05 date: 2026-11-04 section: "Guides" --- # Add OAuth metadata | Agent Ready Checklist > How to add OAuth metadata. Publish authorization server and protected resource metadata so an agent can start a delegated flow without reading your docs. Source: https://agentreadychecklist.com/guides/add-oauth-metadata Site: Agent Ready Checklist Last reviewed: 2026-11-05 Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search) Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free). # How to add OAuth metadata Publish authorization server and protected resource metadata so an agent can start a delegated flow without reading your docs. It covers 3 requirements: AR-ACT-01, CF-OAUTH-DISCOVERY, AR-ACT-03. RFC 9728 defines protected resource metadata at /.well-known/oauth-protected-resource with resource and authorization\_servers. RFC 7636 defines PKCE, the code\_challenge and code\_verifier pair for public clients. RFC 8414 defines authorization server metadata at /.well-known/oauth-authorization-server. ## Before you start You need an authorization server that already issues tokens, and its issuer URL and endpoints. ## Steps 1. **[AR-ACT-01: Auth an agent can finish.](https://agentreadychecklist.com/checklist/ar-act-01/)** Make authentication completable by an agent: self-serve keys with documented scopes; for user-delegated access, OAuth 2.0 with metadata under /.well-known. ```bash curl -fsSL https://agentreadychecklist.com/kit/verify.sh | bash -s -- https://example.com --only=oauth-metadata ``` Watch for: Key creation that requires a sales call. 2. **[CF-OAUTH-DISCOVERY: OAuth discovery files.](https://agentreadychecklist.com/checklist/cf-oauth-discovery/)** Serve OAuth or OIDC discovery JSON at /.well-known/oauth-authorization-server or /.well-known/openid-configuration with issuer, authorization\_endpoint, token\_endpoint and jwks\_uri; serve RFC 9728 metadata at /.well-known/oauth-protected-resource. ```bash curl -fsSL https://agentreadychecklist.com/kit/verify.sh | bash -s -- https://example.com --only=oauth-metadata ``` Watch for: Metadata only on the identity provider host, nothing on the resource host. 3. **[AR-ACT-03: MCP over Streamable HTTP.](https://agentreadychecklist.com/checklist/ar-act-03/)** Expose an MCP server over Streamable HTTP at /mcp; keep the docs MCP public and gate the product MCP with OAuth and PKCE; list it in the MCP Registry with a server.json. ```bash curl -fsSL https://agentreadychecklist.com/kit/verify.sh | bash -s -- https://example.com --only=mcp-or-cli ``` Watch for: Server only reachable over stdio from a local install. 4. **Protected resource metadata.** RFC 9728 defines the document at /.well-known/oauth-protected-resource. It names the resource and the authorization servers that can issue tokens for it. ```json {"resource":"https://example.com/mcp","authorization_servers":["https://auth.example.com"]} ``` ## How you know it is done You are done when the authorization server and protected resource documents both parse, name each other, and the kit oauth-metadata check prints PASS. ## The facts behind it - RFC 8414 defines authorization server metadata at /.well-known/oauth-authorization-server.primary source: [rfc-editor.org/rfc/rfc8414](https://www.rfc-editor.org/rfc/rfc8414), read 2026-11-04 - RFC 9728 defines protected resource metadata at /.well-known/oauth-protected-resource with resource and authorization\_servers.primary source: [rfc-editor.org/rfc/rfc9728](https://www.rfc-editor.org/rfc/rfc9728), read 2026-11-04 - MCP authorization requires servers to implement protected resource metadata and requires PKCE.primary source, 2025-06-18: [modelcontextprotocol.io/specification/2025-06-18/basic/authorization](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization), read 2026-11-04 - RFC 7636 defines PKCE, the code\_challenge and code\_verifier pair for public clients.primary source: [rfc-editor.org/rfc/rfc7636](https://www.rfc-editor.org/rfc/rfc7636), read 2026-11-04 - Cloudflare checks OAuth discovery and OAuth Protected Resource as two separate checks.primary source, 2026-11-04: [isitagentready.com](https://isitagentready.com/), read 2026-11-04 ## Sources - [rfc-editor.org/rfc/rfc8414](https://www.rfc-editor.org/rfc/rfc8414)read 2026-11-04 - [rfc-editor.org/rfc/rfc9728](https://www.rfc-editor.org/rfc/rfc9728)read 2026-11-04 - [modelcontextprotocol.io/specification/2025-06-18/basic/authorization](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization)read 2026-11-04 - [rfc-editor.org/rfc/rfc7636](https://www.rfc-editor.org/rfc/rfc7636)read 2026-11-04 - [isitagentready.com](https://isitagentready.com/)read 2026-11-04 Edition Data 2026-11-04 Reviewed 2026-11-05 Spec AgentReady v2.0, 273d2d7 Crawl 13,071 rows, 2026-11-04 Ora 132 checks, contract 1.38.0, 2026-11-05 Verify with Ora The scanner this site recommends for the whole checklist. 132 checks, a score out of 100, no account. `npx ax@0.10 audit --min-score ` [Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/) Method - [How rows, commands and rates are made](https://agentreadychecklist.com/method/) - [How an Ora check is matched to a row](https://agentreadychecklist.com/checklist/ora-checks/) - [Pass rates by rank band](https://agentreadychecklist.com/data/by-rank/) Sources and read dates sit at the foot of the page. Last reviewed 2026-11-05. AgentReady v2.0, read 2026-11-04.