---
name: oauth-protected-resource
title: OAuth Protected Resource
category: discovery
---

# OAuth Protected Resource

Protected Resource Metadata is the other half: it states which resource is protected and which authorization servers issue tokens for it.

## When to use this skill

Use this when a site fails the "OAuth Protected Resource" check and you need to implement it.

## Goal

Publish OAuth Protected Resource Metadata so agents can discover how to authenticate

## Pass criteria

/.well-known/oauth-protected-resource declares resource and authorization_servers.

## Implementation

This skill covers the diagnosis. The step-by-step implementation prompt is part
of the paid tier and is served per scan by the API — see https://agent-ready.t0ols.com/llms-full.txt.

## Specifications

- https://www.rfc-editor.org/rfc/rfc9728

## Verifying

Re-run the scan against the site and confirm the check reports a pass:

    curl -s https://agent-ready.t0ols.com/api/scan \
      -H 'content-type: application/json' \
      -d '{"url":"https://example.com","enabledChecks":["oauthProtectedResource"]}'