Skip to main content

> GUIDE // FOUNDATIONS

OAuth 2.0 Protected Resource Metadata (RFC 9728)

Enabling autonomous agents to discover authorization servers, token endpoints, and scopes via RFC 9728.

Executive Overview

RFC 9728 standardizes how APIs declare their OAuth authorization servers and supported scopes at /.well-known/oauth-protected-resource, removing manual client credentials configuration for AI agents.

1. Implementing /.well-known/oauth-protected-resource

The protected resource document declares:

  • resource: The canonical URI of the protected resource API.
  • authorization_servers: An array of OAuth 2.0 / OIDC issuer URLs where the agent can acquire access tokens.
  • scopes_supported: The list of valid OAuth scopes for machine interaction.

Frequently Asked Questions

How does RFC 9728 pair with RFC 8414?

RFC 9728 tells the agent WHERE the authorization server is located. The agent then queries the authorization server's RFC 8414 /.well-known/oauth-authorization-server to locate token and registration endpoints.

AI Summary

RFC 9728 standardizes how APIs declare their OAuth authorization servers and supported scopes at /.well-known/oauth-protected-resource, removing manual client credentials configuration for AI agents.