---
title: "OAuth Protected Resource | OAuth protected resource metadata RFC 9728 | Agent-Ready Check"
description: "Protected Resource Metadata is the other half: it states which resource is protected and which authorization servers issue tokens for it. Pass criteria: /.well-known/oauth-protected-resource declares resource and authorization_servers."
locale: en
canonical: https://agent-ready.t0ols.com/checks/oauth-protected-resource/
---

# OAuth Protected Resource

> Category: API, Auth, MCP & Skill Discovery

Protected Resource Metadata is the other half: it states which resource is protected and which authorization servers issue tokens for it.

## Why it matters

An agent hitting a 401 can read this document, find the right authorization server and retry without human help.

## Pass criteria

/.well-known/oauth-protected-resource declares resource and authorization_servers.

## How to implement it

Goal: Publish OAuth Protected Resource Metadata so agents can discover how to authenticate

/.well-known/oauth-protected-resource declares resource and authorization_servers.

The step-by-step implementation prompt is part of the paid tier. The free layer gives you the diagnosis, the evidence and the specification links.

Specifications: https://www.rfc-editor.org/rfc/rfc9728
Implementation notes: https://agent-ready.t0ols.com/.well-known/agent-skills/oauth-protected-resource/SKILL.md