# Skill: Expose OAuth Protected Resource Metadata (RFC 9728)

> **Standard:** RFC 9728
> **Category:** PROTOCOL_DISCOVERY
> **Classification:** SPECIFICATION_AND_GUIDE
> **Author:** TinyCTO Architecture Guild (https://tinycto.tv)

## Overview
Serve RFC 9728 metadata at /.well-known/oauth-protected-resource declaring authorization server associations and supported bearer methods.

## Learning Objectives
1. Publish /.well-known/oauth-protected-resource.
2. List authorization_servers, scopes_supported, and resource_documentation.
3. Emit WWW-Authenticate headers referencing the metadata URL on 401 responses.

## Prerequisites
- Protected API routes

## Implementation & Execution Guide

### Step 1: Publish RFC 9728 JSON
Advertise resource scopes and authorization server authority.

```http
{
  "resource": "https://tinycto.tv",
  "authorization_servers": ["https://tinycto.tv"],
  "scopes_supported": ["read:public", "api.read", "admin:operations"],
  "bearer_methods_supported": ["header"],
  "resource_documentation": "https://tinycto.tv/auth.md"
}
```

## Architectural Takeaway
RFC 9728 allows an agent hitting a protected endpoint to discover which OAuth server to authenticate against.