OAuth Protected Resource
Protected Resource Metadata is the other half: it states which resource is protected and which authorization servers issue tokens for it.
Why it matters
An agent hitting a 401 can read this document, find the right authorization server and retry without human help.
Pass criteria
/.well-known/oauth-protected-resource declares resource and authorization_servers.
Every request the check makes is recorded (URL, method, response status, relevant headers and a body preview) and shown under the check in your results.
How to implement it
Publish OAuth Protected Resource Metadata so agents can discover how to authenticate
/.well-known/oauth-protected-resource declares resource and authorization_servers.
The step-by-step implementation prompt is part of the Pro plan.
See plansScan your site
See whether this check passes on your domain, along with the other 21.
Related checks
API Catalog
/.well-known/api-catalog returns application/linkset+json with at least one entry.
OAuth discovery
/.well-known/oauth-authorization-server or /.well-known/openid-configuration exposes usable metadata.
Auth.md
/auth.md exists with a markdown H1 mentioning auth.md.
MCP Server Card
/.well-known/mcp/server-card.json describes the server with a serverInfo.name.
A2A Agent Card
/.well-known/agent-card.json declares name, version and supported interfaces.
Agent Skills
/.well-known/agent-skills/index.json lists at least one skill.
WebMCP
Page code registers browser-side tools through navigator.modelContext.
ARD manifest
/.well-known/ai-catalog.json declares specVersion, host and at least one entry.